

<!DOCTYPE html>
<html lang="zh-CN" data-default-color-scheme=&#34;light&#34;>



<head>
  <meta charset="UTF-8">
  <link rel="apple-touch-icon" sizes="76x76" href="https://cdn.jsdelivr.net/gh/kzwrime/kzwrime.github.io/img/favicon.png">
  <link rel="icon" type="image/png" href="https://tuchuangrrr.oss-cn-shenzhen.aliyuncs.com/img/kunnan.png">
  <meta name="viewport"
        content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no, shrink-to-fit=no">
  <meta http-equiv="x-ua-compatible" content="ie=edge">
  
  <meta name="theme-color" content="#2f4154">
  <meta name="description" content="">
  <meta name="author" content="霜华">
  <meta name="keywords" content="">
  <title>bomb lab - kunzh</title>

  <link  rel="stylesheet" href="https://cdn.staticfile.org/twitter-bootstrap/4.4.1/css/bootstrap.min.css" />


  <link  rel="stylesheet" href="https://cdn.staticfile.org/github-markdown-css/4.0.0/github-markdown.min.css" />
  <link  rel="stylesheet" href="/lib/hint/hint.min.css" />

  
    
    
      
      <link  rel="stylesheet" href="https://cdn.staticfile.org/highlight.js/10.0.0/styles/atelier-lakeside-dark.min.css" />
    
  

  


<!-- 主题依赖的图标库，不要自行修改 -->

<link rel="stylesheet" href="//at.alicdn.com/t/font_1749284_pf9vaxs7x7b.css">



<link rel="stylesheet" href="//at.alicdn.com/t/font_1736178_kmeydafke9r.css">


<link  rel="stylesheet" href="/css/main.css" />

<!-- 自定义样式保持在最底部 -->


  <script  src="/js/utils.js" ></script>
  <script  src="/js/color-schema.js" ></script>
</head>


<body>
  <header style="height: 60vh;">
    <nav id="navbar" class="navbar fixed-top  navbar-expand-lg navbar-dark scrolling-navbar">
  <div class="container">
    <a class="navbar-brand"
       href="/">&nbsp;<strong>kunzh</strong>&nbsp;</a>

    <button id="navbar-toggler-btn" class="navbar-toggler" type="button" data-toggle="collapse"
            data-target="#navbarSupportedContent"
            aria-controls="navbarSupportedContent" aria-expanded="false" aria-label="Toggle navigation">
      <div class="animated-icon"><span></span><span></span><span></span></div>
    </button>

    <!-- Collapsible content -->
    <div class="collapse navbar-collapse" id="navbarSupportedContent">
      <ul class="navbar-nav ml-auto text-center">
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/">
                <i class="iconfont icon-home-fill"></i>
                首页
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/archives/">
                <i class="iconfont icon-archive-fill"></i>
                归档
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/categories/">
                <i class="iconfont icon-category-fill"></i>
                分类
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/tags/">
                <i class="iconfont icon-tags-fill"></i>
                标签
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/about/">
                <i class="iconfont icon-user-fill"></i>
                关于
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/links/">
                <i class="iconfont icon-link-fill"></i>
                友链
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/shuoshuo2/">
                <i class="iconfont icon-speakernotes"></i>
                留言板
              </a>
            </li>
          
        
        
          <li class="nav-item" id="search-btn">
            <a class="nav-link" data-toggle="modal" data-target="#modalSearch">&nbsp;<i
                class="iconfont icon-search"></i>&nbsp;</a>
          </li>
        
        
          <li class="nav-item" id="color-toggle-btn">
            <a class="nav-link" href="javascript:">&nbsp;<i
                class="iconfont icon-dark" id="color-toggle-icon"></i>&nbsp;</a>
          </li>
        
      </ul>
    </div>
  </div>
</nav>

    <div class="banner intro-2" id="background" parallax=true
         style="background: url('https://rainrime.top/img/SloveniaAlps.jpg') no-repeat center center;
           background-size: cover;">
      <div class="full-bg-img">
        <div class="mask flex-center" style="background-color: rgba(0, 0, 0, 0.3)">
          <div class="container page-header text-center fade-in-up">
            <span class="h2" id="subtitle">
              
            </span>

            
              <div class="mt-3">
  
  
    <span class="post-meta">
      <i class="iconfont icon-date-fill" aria-hidden="true"></i>
      <time datetime="2020-11-01 14:50" pubdate>
        2020年11月1日 下午
      </time>
    </span>
  
</div>

<div class="mt-1">
  
    
    <span class="post-meta mr-2">
      <i class="iconfont icon-chart"></i>
      6.3k 字
    </span>
  

  
    
    <span class="post-meta mr-2">
      <i class="iconfont icon-clock-fill"></i>
      
      
      111
       分钟
    </span>
  

  
  
    
      <!-- LeanCloud 统计文章PV -->
      <span id="leancloud-post-views-container" class="post-meta" style="display: none">
        <i class="iconfont icon-eye" aria-hidden="true"></i>
        <span id="leancloud-post-views"></span> 次
      </span>
    
  
</div>

            
          </div>

          
        </div>
      </div>
    </div>
  </header>

  <main>
    
      

<div class="container-fluid">
  <div class="row">
    <div class="d-none d-lg-block col-lg-2"></div>
    <div class="col-lg-8 nopadding-md">
      <div class="container nopadding-md" id="board-ctn">
        <div class="py-5" id="board">
          <article class="post-content mx-auto" id="post">
            <!-- SEO header -->
            <h1 style="display: none">bomb lab</h1>
            
            <div class="markdown-body" id="post-body">
              <p>没有 gdb 使用经验的可以先看本博客另一篇文章  <a target="_blank" rel="noopener" href="https://rainrime.top/2020/10/gdb-stack/">gdb 调试</a>，里面也附有 gdb 基本指令及说明表格</p>
<p>以下为正文</p>
<hr />
<p>先把反汇编输出到单独的文件里方便查看及注释</p>
<pre><code class="hljs bash">objdump -d bomb &gt; bomb.s</code></pre>
<h2 id="phase_1"><a class="markdownIt-Anchor" href="#phase_1"></a> phase_1</h2>
<p>定位到这一段，基本代码及说明如下</p>
<pre><code class="hljs apache"><span class="hljs-attribute">0000000000400ee0</span> &lt;phase_<span class="hljs-number">1</span>&gt;:
  <span class="hljs-attribute">400ee0</span>:	<span class="hljs-number">48</span> <span class="hljs-number">83</span> ec <span class="hljs-number">08</span>          	sub    $<span class="hljs-number">0</span>x<span class="hljs-number">8</span>,%rsp              # 分配栈空间
  <span class="hljs-attribute">400ee4</span>:	be <span class="hljs-number">00</span> <span class="hljs-number">24</span> <span class="hljs-number">40</span> <span class="hljs-number">00</span>       	mov    $<span class="hljs-number">0</span>x<span class="hljs-number">402400</span>,%esi         # 传参
  <span class="hljs-attribute">400ee9</span>:	e<span class="hljs-number">8</span> <span class="hljs-number">4</span>a <span class="hljs-number">04</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	callq  <span class="hljs-number">401338</span> &lt;strings_not_equal&gt; # 调用
  <span class="hljs-attribute">400eee</span>:	<span class="hljs-number">85</span> c<span class="hljs-number">0</span>                	test   %eax,%eax              # 检验返回值是否为<span class="hljs-number">0</span>
  <span class="hljs-attribute">400ef0</span>:	<span class="hljs-number">74</span> <span class="hljs-number">05</span>                	je     <span class="hljs-number">400</span>ef<span class="hljs-number">7</span> &lt;phase_<span class="hljs-number">1</span>+<span class="hljs-number">0</span>x<span class="hljs-number">17</span>&gt;  # 为 <span class="hljs-number">0</span> 则正常
  <span class="hljs-attribute">400ef2</span>:	e<span class="hljs-number">8</span> <span class="hljs-number">43</span> <span class="hljs-number">05</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	callq  <span class="hljs-number">40143</span>a &lt;explode_bomb&gt;  # 否则 boom~~~
  <span class="hljs-attribute">400ef7</span>:	<span class="hljs-number">48</span> <span class="hljs-number">83</span> c<span class="hljs-number">4</span> <span class="hljs-number">08</span>          	add    $<span class="hljs-number">0</span>x<span class="hljs-number">8</span>,%rsp              # 释放栈空间
  <span class="hljs-attribute">400efb</span>:	c<span class="hljs-number">3</span>                   	retq</code></pre>
<p>可以判断，关键在于地址<code>0x402400</code>处的内容，由函数名<code>&lt;strings_not_equal&gt;</code>判断这是个字符串，可以由多个方式查看，gdb 设断点后，查看如下，即可得到答案</p>
<pre><code class="hljs ada">(gdb) x/s <span class="hljs-number">0</span>x402400
<span class="hljs-number">0</span>x402400 :       &quot;<span class="hljs-type">Border</span> relations <span class="hljs-keyword">with</span> Canada have never been better.<span class="hljs-string">&quot;</span></code></pre>
<p>当然也可以直接看二进制，直接确定答案，注意里面的 <code>.</code> 并不能确定是什么，要看一下 16 进制，如<code>20</code>就是空格</p>
<pre><code class="hljs apache"><span class="hljs-attribute">000023e0</span>: <span class="hljs-number">6</span>F <span class="hljs-number">74</span> <span class="hljs-number">20</span> <span class="hljs-number">74</span> <span class="hljs-number">68</span> <span class="hljs-number">61</span> <span class="hljs-number">74</span> <span class="hljs-number">20</span> <span class="hljs-number">6</span>F <span class="hljs-number">6</span>E <span class="hljs-number">65</span> <span class="hljs-number">2</span>E <span class="hljs-number">20</span> <span class="hljs-number">20</span> <span class="hljs-number">54</span> <span class="hljs-number">72</span>    ot.that.one...Tr
<span class="hljs-attribute">000023f0</span>: <span class="hljs-number">79</span> <span class="hljs-number">20</span> <span class="hljs-number">74</span> <span class="hljs-number">68</span> <span class="hljs-number">69</span> <span class="hljs-number">73</span> <span class="hljs-number">20</span> <span class="hljs-number">6</span>F <span class="hljs-number">6</span>E <span class="hljs-number">65</span> <span class="hljs-number">2</span>E <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>    y.this.one......
<span class="hljs-attribute">00002400</span>: <span class="hljs-number">42</span> <span class="hljs-number">6</span>F <span class="hljs-number">72</span> <span class="hljs-number">64</span> <span class="hljs-number">65</span> <span class="hljs-number">72</span> <span class="hljs-number">20</span> <span class="hljs-number">72</span> <span class="hljs-number">65</span> <span class="hljs-number">6</span>C <span class="hljs-number">61</span> <span class="hljs-number">74</span> <span class="hljs-number">69</span> <span class="hljs-number">6</span>F <span class="hljs-number">6</span>E <span class="hljs-number">73</span>    Border.relations
<span class="hljs-attribute">00002410</span>: <span class="hljs-number">20</span> <span class="hljs-number">77</span> <span class="hljs-number">69</span> <span class="hljs-number">74</span> <span class="hljs-number">68</span> <span class="hljs-number">20</span> <span class="hljs-number">43</span> <span class="hljs-number">61</span> <span class="hljs-number">6</span>E <span class="hljs-number">61</span> <span class="hljs-number">64</span> <span class="hljs-number">61</span> <span class="hljs-number">20</span> <span class="hljs-number">68</span> <span class="hljs-number">61</span> <span class="hljs-number">76</span>    .with.Canada.hav
<span class="hljs-attribute">00002420</span>: <span class="hljs-number">65</span> <span class="hljs-number">20</span> <span class="hljs-number">6</span>E <span class="hljs-number">65</span> <span class="hljs-number">76</span> <span class="hljs-number">65</span> <span class="hljs-number">72</span> <span class="hljs-number">20</span> <span class="hljs-number">62</span> <span class="hljs-number">65</span> <span class="hljs-number">65</span> <span class="hljs-number">6</span>E <span class="hljs-number">20</span> <span class="hljs-number">62</span> <span class="hljs-number">65</span> <span class="hljs-number">74</span>    e.never.been.bet
<span class="hljs-attribute">00002430</span>: <span class="hljs-number">74</span> <span class="hljs-number">65</span> <span class="hljs-number">72</span> <span class="hljs-number">2</span>E <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">57</span> <span class="hljs-number">6</span>F <span class="hljs-number">77</span> <span class="hljs-number">21</span> <span class="hljs-number">20</span> <span class="hljs-number">59</span> <span class="hljs-number">6</span>F <span class="hljs-number">75</span>    ter.....Wow!.You
<span class="hljs-attribute">00002440</span>: <span class="hljs-number">27</span> <span class="hljs-number">76</span> <span class="hljs-number">65</span> <span class="hljs-number">20</span> <span class="hljs-number">64</span> <span class="hljs-number">65</span> <span class="hljs-number">66</span> <span class="hljs-number">75</span> <span class="hljs-number">73</span> <span class="hljs-number">65</span> <span class="hljs-number">64</span> <span class="hljs-number">20</span> <span class="hljs-number">74</span> <span class="hljs-number">68</span> <span class="hljs-number">65</span> <span class="hljs-number">20</span>    &#x27;ve.defused.the.
<span class="hljs-attribute">00002450</span>: <span class="hljs-number">73</span> <span class="hljs-number">65</span> <span class="hljs-number">63</span> <span class="hljs-number">72</span> <span class="hljs-number">65</span> <span class="hljs-number">74</span> <span class="hljs-number">20</span> <span class="hljs-number">73</span> <span class="hljs-number">74</span> <span class="hljs-number">61</span> <span class="hljs-number">67</span> <span class="hljs-number">65</span> <span class="hljs-number">21</span> <span class="hljs-number">00</span> <span class="hljs-number">66</span> <span class="hljs-number">6</span>C    secret.stage!.fl</code></pre>
<p>以下基本会给出这两种方式，但不再说明。</p>
<p>反正得到了答案</p>
<pre><code class="hljs mipsasm"><span class="hljs-keyword">Border </span>relations with Canada have never <span class="hljs-keyword">been </span><span class="hljs-keyword">better.</span></code></pre>
<h2 id="phase_2"><a class="markdownIt-Anchor" href="#phase_2"></a> phase_2</h2>
<p>定位到这一段，基本代码及说明如下</p>
<pre><code class="hljs apache"><span class="hljs-attribute">0000000000400efc</span> &lt;phase_<span class="hljs-number">2</span>&gt;:
  <span class="hljs-attribute">400efc</span>:	<span class="hljs-number">55</span>                   	push   %rbp
  <span class="hljs-attribute">400efd</span>:	<span class="hljs-number">53</span>                   	push   %rbx
  <span class="hljs-attribute">400efe</span>:	<span class="hljs-number">48</span> <span class="hljs-number">83</span> ec <span class="hljs-number">28</span>          	sub    $<span class="hljs-number">0</span>x<span class="hljs-number">28</span>,%rsp             # 分配栈空间
  <span class="hljs-attribute">400f02</span>:	<span class="hljs-number">48</span> <span class="hljs-number">89</span> e<span class="hljs-number">6</span>             	mov    %rsp,%rsi              # 传参，(%rsp+<span class="hljs-number">0</span>/<span class="hljs-number">4</span>/<span class="hljs-number">8</span>/.../<span class="hljs-number">14</span>)为返回值，六个
  <span class="hljs-attribute">400f05</span>:	e<span class="hljs-number">8</span> <span class="hljs-number">52</span> <span class="hljs-number">05</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	callq  <span class="hljs-number">40145</span>c &lt;read_six_numbers&gt;
  <span class="hljs-attribute">400f0a</span>:	<span class="hljs-number">83</span> <span class="hljs-number">3</span>c <span class="hljs-number">24</span> <span class="hljs-number">01</span>          	cmpl   $<span class="hljs-number">0</span>x<span class="hljs-number">1</span>,(%rsp)            # 确定(%rsp)是否为 <span class="hljs-number">1</span>
  <span class="hljs-attribute">400f0e</span>:	<span class="hljs-number">74</span> <span class="hljs-number">20</span>                	je     <span class="hljs-number">400</span>f<span class="hljs-number">30</span> &lt;phase_<span class="hljs-number">2</span>+<span class="hljs-number">0</span>x<span class="hljs-number">34</span>&gt;  # 为 <span class="hljs-number">1</span> 则正常，跳转
  <span class="hljs-attribute">400f10</span>:	e<span class="hljs-number">8</span> <span class="hljs-number">25</span> <span class="hljs-number">05</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	callq  <span class="hljs-number">40143</span>a &lt;explode_bomb&gt;  # 否则 boom~~~
  <span class="hljs-attribute">400f15</span>:	eb <span class="hljs-number">19</span>                	jmp    <span class="hljs-number">400</span>f<span class="hljs-number">30</span> &lt;phase_<span class="hljs-number">2</span>+<span class="hljs-number">0</span>x<span class="hljs-number">34</span>&gt;  # -----以下为循环,不断改变 %rbx-----
  <span class="hljs-attribute">400f17</span>:	<span class="hljs-number">8</span>b <span class="hljs-number">43</span> fc             	mov    -<span class="hljs-number">0</span>x<span class="hljs-number">4</span>(%rbx),%eax        # 其实就是判断 a_(i-<span class="hljs-number">1</span>) * <span class="hljs-number">2</span> == a_i ?
  <span class="hljs-attribute">400f1a</span>:	<span class="hljs-number">01</span> c<span class="hljs-number">0</span>                	add    %eax,%eax
  <span class="hljs-attribute">400f1c</span>:	<span class="hljs-number">39</span> <span class="hljs-number">03</span>                	cmp    %eax,(%rbx)            # 确定 <span class="hljs-number">2</span>*(%rbx-<span class="hljs-number">4</span>) 是否等于 (%rbx)
  <span class="hljs-attribute">400f1e</span>:	<span class="hljs-number">74</span> <span class="hljs-number">05</span>                	je     <span class="hljs-number">400</span>f<span class="hljs-number">25</span> &lt;phase_<span class="hljs-number">2</span>+<span class="hljs-number">0</span>x<span class="hljs-number">29</span>&gt;  # 是，正常，跳转
  <span class="hljs-attribute">400f20</span>:	e<span class="hljs-number">8</span> <span class="hljs-number">15</span> <span class="hljs-number">05</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	callq  <span class="hljs-number">40143</span>a &lt;explode_bomb&gt;  # 否则 boom~~~
  <span class="hljs-attribute">400f25</span>:	<span class="hljs-number">48</span> <span class="hljs-number">83</span> c<span class="hljs-number">3</span> <span class="hljs-number">04</span>          	add    $<span class="hljs-number">0</span>x<span class="hljs-number">4</span>,%rbx              # %rbx += <span class="hljs-number">4</span>
  <span class="hljs-attribute">400f29</span>:	<span class="hljs-number">48</span> <span class="hljs-number">39</span> eb             	cmp    %rbp,%rbx              # %rbp == %rbx ？
  <span class="hljs-attribute">400f2c</span>:	<span class="hljs-number">75</span> e<span class="hljs-number">9</span>                	jne    <span class="hljs-number">400</span>f<span class="hljs-number">17</span> &lt;phase_<span class="hljs-number">2</span>+<span class="hljs-number">0</span>x<span class="hljs-number">1</span>b&gt;  # 不等，回到前面继续
  <span class="hljs-attribute">400f2e</span>:	eb <span class="hljs-number">0</span>c                	jmp    <span class="hljs-number">400</span>f<span class="hljs-number">3</span>c &lt;phase_<span class="hljs-number">2</span>+<span class="hljs-number">0</span>x<span class="hljs-number">40</span>&gt;  # 跳转结束-------以下为循环初始化----
  <span class="hljs-attribute">400f30</span>:	<span class="hljs-number">48</span> <span class="hljs-number">8</span>d <span class="hljs-number">5</span>c <span class="hljs-number">24</span> <span class="hljs-number">04</span>       	lea    <span class="hljs-number">0</span>x<span class="hljs-number">4</span>(%rsp),%rbx         # 读出前面 read_six_numbers 处理结果
  <span class="hljs-attribute">400f35</span>:	<span class="hljs-number">48</span> <span class="hljs-number">8</span>d <span class="hljs-number">6</span>c <span class="hljs-number">24</span> <span class="hljs-number">18</span>       	lea    <span class="hljs-number">0</span>x<span class="hljs-number">18</span>(%rsp),%rbp        # 循环次数 (%rbp - %rbx) / <span class="hljs-number">4</span> = <span class="hljs-number">5</span> 次
  <span class="hljs-attribute">400f3a</span>:	eb db                	jmp    <span class="hljs-number">400</span>f<span class="hljs-number">17</span> &lt;phase_<span class="hljs-number">2</span>+<span class="hljs-number">0</span>x<span class="hljs-number">1</span>b&gt;  # ----------------------------------
  <span class="hljs-attribute">400f3c</span>:	<span class="hljs-number">48</span> <span class="hljs-number">83</span> c<span class="hljs-number">4</span> <span class="hljs-number">28</span>          	add    $<span class="hljs-number">0</span>x<span class="hljs-number">28</span>,%rsp             # 释放栈空间
  <span class="hljs-attribute">400f40</span>:	<span class="hljs-number">5</span>b                   	pop    %rbx
  <span class="hljs-attribute">400f41</span>:	<span class="hljs-number">5</span>d                   	pop    %rbp
  <span class="hljs-attribute">400f42</span>:	c<span class="hljs-number">3</span>                   	retq</code></pre>
<p>基本可以确定是一个循环，判断一个首地址为<code>$rsp</code>数组是否为 [1,2,4,8,16,32]，但不知道<code>&lt;read_six_numbers&gt;</code>到底怎么读和怎么存的，查看一下</p>
<pre><code class="hljs yaml"><span class="hljs-string">000000000040145c</span> <span class="hljs-string">&lt;read_six_numbers&gt;:</span>   <span class="hljs-comment"># 读六个数字，分别在 %rdx, %rcx, %r8, %r9,</span>
  <span class="hljs-attr">40145c:</span>	<span class="hljs-number">48</span> <span class="hljs-number">83</span> <span class="hljs-string">ec</span> <span class="hljs-number">18</span>          	<span class="hljs-string">sub</span>    <span class="hljs-string">$0x18,%rsp</span>       <span class="hljs-comment">#  (%rsp), 0x8(%rsp)</span>
  <span class="hljs-attr">401460:</span>	<span class="hljs-number">48</span> <span class="hljs-number">89</span> <span class="hljs-string">f2</span>             	<span class="hljs-string">mov</span>    <span class="hljs-string">%rsi,%rdx</span>        
  <span class="hljs-attr">401463:</span>	<span class="hljs-number">48</span> <span class="hljs-string">8d</span> <span class="hljs-string">4e</span> <span class="hljs-number">04</span>          	<span class="hljs-string">lea</span>    <span class="hljs-number">0x4</span><span class="hljs-string">(%rsi),%rcx</span>   
  <span class="hljs-attr">401467:</span>	<span class="hljs-number">48</span> <span class="hljs-string">8d</span> <span class="hljs-number">46</span> <span class="hljs-number">14</span>          	<span class="hljs-string">lea</span>    <span class="hljs-number">0x14</span><span class="hljs-string">(%rsi),%rax</span>
  <span class="hljs-attr">40146b:</span>	<span class="hljs-number">48</span> <span class="hljs-number">89</span> <span class="hljs-number">44</span> <span class="hljs-number">24</span> <span class="hljs-number">08</span>       	<span class="hljs-string">mov</span>    <span class="hljs-string">%rax,0x8(%rsp)</span>
  <span class="hljs-attr">401470:</span>	<span class="hljs-number">48</span> <span class="hljs-string">8d</span> <span class="hljs-number">46</span> <span class="hljs-number">10</span>          	<span class="hljs-string">lea</span>    <span class="hljs-number">0x10</span><span class="hljs-string">(%rsi),%rax</span>
  <span class="hljs-attr">401474:</span>	<span class="hljs-number">48</span> <span class="hljs-number">89</span> <span class="hljs-number">04</span> <span class="hljs-number">24</span>          	<span class="hljs-string">mov</span>    <span class="hljs-string">%rax,(%rsp)</span>
  <span class="hljs-attr">401478:</span>	<span class="hljs-string">4c</span> <span class="hljs-string">8d</span> <span class="hljs-string">4e</span> <span class="hljs-string">0c</span>          	<span class="hljs-string">lea</span>    <span class="hljs-number">0xc</span><span class="hljs-string">(%rsi),%r9</span>
  <span class="hljs-attr">40147c:</span>	<span class="hljs-string">4c</span> <span class="hljs-string">8d</span> <span class="hljs-number">46</span> <span class="hljs-number">08</span>          	<span class="hljs-string">lea</span>    <span class="hljs-number">0x8</span><span class="hljs-string">(%rsi),%r8</span>
  <span class="hljs-attr">401480:</span>	<span class="hljs-string">be</span> <span class="hljs-string">c3</span> <span class="hljs-number">25</span> <span class="hljs-number">40</span> <span class="hljs-number">00</span>       	<span class="hljs-string">mov</span>    <span class="hljs-string">$0x4025c3,%esi</span>   <span class="hljs-comment"># &quot;%d %d %d %d %d %d&quot;</span>
  <span class="hljs-attr">401485:</span>	<span class="hljs-string">b8</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	<span class="hljs-string">mov</span>    <span class="hljs-string">$0x0,%eax</span>		<span class="hljs-comment"># sscanf(buffer, %d %d %d %d %d %d&quot;, \</span>
  <span class="hljs-attr">40148a:</span>	<span class="hljs-string">e8</span> <span class="hljs-number">61</span> <span class="hljs-string">f7</span> <span class="hljs-string">ff</span> <span class="hljs-string">ff</span>       	<span class="hljs-string">callq</span>  <span class="hljs-string">400bf0</span> <span class="hljs-string">&lt;__isoc99_sscanf@plt&gt;</span>	<span class="hljs-comment"># (%rsi), 0x4(%rsi), 0x8(%rsi), \</span>
  <span class="hljs-attr">40148f:</span>	<span class="hljs-number">83</span> <span class="hljs-string">f8</span> <span class="hljs-number">05</span>             	<span class="hljs-string">cmp</span>    <span class="hljs-string">$0x5,%eax</span>					<span class="hljs-comment"># 0xc(%rsi), 0x10(%rsi), 0x14(%rsi))</span>
  <span class="hljs-attr">401492:</span>	<span class="hljs-string">7f</span> <span class="hljs-number">05</span>                	<span class="hljs-string">jg</span>     <span class="hljs-number">401499</span> <span class="hljs-string">&lt;read_six_numbers+0x3d&gt;</span>
  <span class="hljs-attr">401494:</span>	<span class="hljs-string">e8</span> <span class="hljs-string">a1</span> <span class="hljs-string">ff</span> <span class="hljs-string">ff</span> <span class="hljs-string">ff</span>       	<span class="hljs-string">callq</span>  <span class="hljs-string">40143a</span> <span class="hljs-string">&lt;explode_bomb&gt;</span>
  <span class="hljs-attr">401499:</span>	<span class="hljs-number">48</span> <span class="hljs-number">83</span> <span class="hljs-string">c4</span> <span class="hljs-number">18</span>          	<span class="hljs-string">add</span>    <span class="hljs-string">$0x18,%rsp</span>
  <span class="hljs-attr">40149d:</span>	<span class="hljs-string">c3</span>                   	<span class="hljs-string">retq</span></code></pre>
<pre><code class="hljs perl">(gdb) <span class="hljs-keyword">x</span>/<span class="hljs-keyword">s</span> <span class="hljs-number">0x4025c3</span>
<span class="hljs-number">0x4025c3</span>:       <span class="hljs-string">&quot;%d %d %d %d %d %d&quot;</span></code></pre>
<p>原来调用了个<code>sscanf</code>，其格式为<code>int sscanf(const char *str, const char *format, ...)</code>，返回值为正确匹配的个数，此时就是<code>sscanf(buffer, %d %d %d %d %d %d&quot;, (%rsi), 0x4(%rsi), 0x8(%rsi), 0xc(%rsi), 0x10(%rsi), 0x14(%rsi))</code>，输入被存储到上述 6 个地址，也就是前面的数组，因此得到答案</p>
<pre><code class="hljs basic"><span class="hljs-symbol">1 </span><span class="hljs-number">2</span> <span class="hljs-number">4</span> <span class="hljs-number">8</span> <span class="hljs-number">16</span> <span class="hljs-number">32</span></code></pre>
<h2 id="phase_3"><a class="markdownIt-Anchor" href="#phase_3"></a> phase_3</h2>
<p>定位到这一段，基本代码及说明如下</p>
<pre><code class="hljs apache"><span class="hljs-attribute">0000000000400f43</span> &lt;phase_<span class="hljs-number">3</span>&gt;:
  <span class="hljs-attribute">400f43</span>:	<span class="hljs-number">48</span> <span class="hljs-number">83</span> ec <span class="hljs-number">18</span>          	sub    $<span class="hljs-number">0</span>x<span class="hljs-number">18</span>,%rsp
  <span class="hljs-attribute">400f47</span>:	<span class="hljs-number">48</span> <span class="hljs-number">8</span>d <span class="hljs-number">4</span>c <span class="hljs-number">24</span> <span class="hljs-number">0</span>c       	lea    <span class="hljs-number">0</span>xc(%rsp),%rcx         # 传参，<span class="hljs-number">0</span>x<span class="hljs-number">8</span>(%rsp), <span class="hljs-number">0</span>xc(%rsp) 为返回值
  <span class="hljs-attribute">400f4c</span>:	<span class="hljs-number">48</span> <span class="hljs-number">8</span>d <span class="hljs-number">54</span> <span class="hljs-number">24</span> <span class="hljs-number">08</span>       	lea    <span class="hljs-number">0</span>x<span class="hljs-number">8</span>(%rsp),%rdx         # sscanf(%rdi, <span class="hljs-string">&quot;%d %d&quot;</span>, <span class="hljs-number">0</span>x<span class="hljs-number">8</span>(%rsp), <span class="hljs-number">0</span>xc(%rsp))
  <span class="hljs-attribute">400f51</span>:	be cf <span class="hljs-number">25</span> <span class="hljs-number">40</span> <span class="hljs-number">00</span>       	mov    $<span class="hljs-number">0</span>x<span class="hljs-number">4025</span>cf,%esi         # <span class="hljs-string">&quot;%d %d&quot;</span>
  <span class="hljs-attribute">400f56</span>:	b<span class="hljs-number">8</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	mov    $<span class="hljs-number">0</span>x<span class="hljs-number">0</span>,%eax
  <span class="hljs-attribute">400f5b</span>:	e<span class="hljs-number">8</span> <span class="hljs-number">90</span> fc ff ff       	callq  <span class="hljs-number">400</span>bf<span class="hljs-number">0</span> &lt;__isoc<span class="hljs-number">99</span>_sscanf@plt&gt;
  <span class="hljs-attribute">400f60</span>:	<span class="hljs-number">83</span> f<span class="hljs-number">8</span> <span class="hljs-number">01</span>             	cmp    $<span class="hljs-number">0</span>x<span class="hljs-number">1</span>,%eax              # 返回值 &gt;<span class="hljs-number">1</span> 则正常，否则 boom~~~
  <span class="hljs-attribute">400f63</span>:	<span class="hljs-number">7</span>f <span class="hljs-number">05</span>                	jg     <span class="hljs-number">400</span>f<span class="hljs-number">6</span>a &lt;phase_<span class="hljs-number">3</span>+<span class="hljs-number">0</span>x<span class="hljs-number">27</span>&gt;  # jg 有符号数 &gt;
  <span class="hljs-attribute">400f65</span>:	e<span class="hljs-number">8</span> d<span class="hljs-number">0</span> <span class="hljs-number">04</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	callq  <span class="hljs-number">40143</span>a &lt;explode_bomb&gt;  # --------以下为 switch 结构 -----
  <span class="hljs-attribute">400f6a</span>:	<span class="hljs-number">83</span> <span class="hljs-number">7</span>c <span class="hljs-number">24</span> <span class="hljs-number">08</span> <span class="hljs-number">07</span>       	cmpl   $<span class="hljs-number">0</span>x<span class="hljs-number">7</span>,<span class="hljs-number">0</span>x<span class="hljs-number">8</span>(%rsp)         # 第二个返回值 &gt;<span class="hljs-number">7</span> 则跳转 boom~~~
  <span class="hljs-attribute">400f6f</span>:	<span class="hljs-number">77</span> <span class="hljs-number">3</span>c                	ja     <span class="hljs-number">400</span>fad &lt;phase_<span class="hljs-number">3</span>+<span class="hljs-number">0</span>x<span class="hljs-number">6</span>a&gt;  # ja 无符号数 &gt;
  <span class="hljs-attribute">400f71</span>:	<span class="hljs-number">8</span>b <span class="hljs-number">44</span> <span class="hljs-number">24</span> <span class="hljs-number">08</span>          	mov    <span class="hljs-number">0</span>x<span class="hljs-number">8</span>(%rsp),%eax       
  <span class="hljs-attribute">400f75</span>:	ff <span class="hljs-number">24</span> c<span class="hljs-number">5</span> <span class="hljs-number">70</span> <span class="hljs-number">24</span> <span class="hljs-number">40</span> <span class="hljs-number">00</span> 	jmpq   *<span class="hljs-number">0</span>x<span class="hljs-number">402470</span>(,%rax,<span class="hljs-number">8</span>)     # 跳转表
  <span class="hljs-attribute">400f7c</span>:	b<span class="hljs-number">8</span> cf <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	mov    $<span class="hljs-number">0</span>xcf,%eax             # case <span class="hljs-number">0</span>: a = <span class="hljs-number">0</span>xcf = <span class="hljs-number">207</span>
  <span class="hljs-attribute">400f81</span>:	eb <span class="hljs-number">3</span>b                	jmp    <span class="hljs-number">400</span>fbe &lt;phase_<span class="hljs-number">3</span>+<span class="hljs-number">0</span>x<span class="hljs-number">7</span>b&gt;
  <span class="hljs-attribute">400f83</span>:	b<span class="hljs-number">8</span> c<span class="hljs-number">3</span> <span class="hljs-number">02</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	mov    $<span class="hljs-number">0</span>x<span class="hljs-number">2</span>c<span class="hljs-number">3</span>,%eax            # case <span class="hljs-number">2</span>: a = <span class="hljs-number">0</span>x<span class="hljs-number">2</span>c<span class="hljs-number">3</span> = <span class="hljs-number">707</span>
  <span class="hljs-attribute">400f88</span>:	eb <span class="hljs-number">34</span>                	jmp    <span class="hljs-number">400</span>fbe &lt;phase_<span class="hljs-number">3</span>+<span class="hljs-number">0</span>x<span class="hljs-number">7</span>b&gt;  
  <span class="hljs-attribute">400f8a</span>:	b<span class="hljs-number">8</span> <span class="hljs-number">00</span> <span class="hljs-number">01</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	mov    $<span class="hljs-number">0</span>x<span class="hljs-number">100</span>,%eax            # case <span class="hljs-number">3</span>: a = <span class="hljs-number">0</span>x<span class="hljs-number">100</span> = <span class="hljs-number">256</span>
  <span class="hljs-attribute">400f8f</span>:	eb <span class="hljs-number">2</span>d                	jmp    <span class="hljs-number">400</span>fbe &lt;phase_<span class="hljs-number">3</span>+<span class="hljs-number">0</span>x<span class="hljs-number">7</span>b&gt;  
  <span class="hljs-attribute">400f91</span>:	b<span class="hljs-number">8</span> <span class="hljs-number">85</span> <span class="hljs-number">01</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	mov    $<span class="hljs-number">0</span>x<span class="hljs-number">185</span>,%eax            # case <span class="hljs-number">4</span>: a = <span class="hljs-number">0</span>x<span class="hljs-number">185</span> = <span class="hljs-number">389</span>
  <span class="hljs-attribute">400f96</span>:	eb <span class="hljs-number">26</span>                	jmp    <span class="hljs-number">400</span>fbe &lt;phase_<span class="hljs-number">3</span>+<span class="hljs-number">0</span>x<span class="hljs-number">7</span>b&gt;
  <span class="hljs-attribute">400f98</span>:	b<span class="hljs-number">8</span> ce <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	mov    $<span class="hljs-number">0</span>xce,%eax             # case <span class="hljs-number">5</span>: a = <span class="hljs-number">0</span>xce = <span class="hljs-number">206</span>
  <span class="hljs-attribute">400f9d</span>:	eb <span class="hljs-number">1</span>f                	jmp    <span class="hljs-number">400</span>fbe &lt;phase_<span class="hljs-number">3</span>+<span class="hljs-number">0</span>x<span class="hljs-number">7</span>b&gt;
  <span class="hljs-attribute">400f9f</span>:	b<span class="hljs-number">8</span> aa <span class="hljs-number">02</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	mov    $<span class="hljs-number">0</span>x<span class="hljs-number">2</span>aa,%eax            # case <span class="hljs-number">6</span>: a = <span class="hljs-number">0</span>x<span class="hljs-number">2</span>aa = <span class="hljs-number">682</span>
  <span class="hljs-attribute">400fa4</span>:	eb <span class="hljs-number">18</span>                	jmp    <span class="hljs-number">400</span>fbe &lt;phase_<span class="hljs-number">3</span>+<span class="hljs-number">0</span>x<span class="hljs-number">7</span>b&gt;
  <span class="hljs-attribute">400fa6</span>:	b<span class="hljs-number">8</span> <span class="hljs-number">47</span> <span class="hljs-number">01</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	mov    $<span class="hljs-number">0</span>x<span class="hljs-number">147</span>,%eax            # case <span class="hljs-number">7</span>: a = <span class="hljs-number">0</span>x<span class="hljs-number">147</span> = <span class="hljs-number">327</span>
  <span class="hljs-attribute">400fab</span>:	eb <span class="hljs-number">11</span>                	jmp    <span class="hljs-number">400</span>fbe &lt;phase_<span class="hljs-number">3</span>+<span class="hljs-number">0</span>x<span class="hljs-number">7</span>b&gt;
  <span class="hljs-attribute">400fad</span>:	e<span class="hljs-number">8</span> <span class="hljs-number">88</span> <span class="hljs-number">04</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	callq  <span class="hljs-number">40143</span>a &lt;explode_bomb&gt;
  <span class="hljs-attribute">400fb2</span>:	b<span class="hljs-number">8</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	mov    $<span class="hljs-number">0</span>x<span class="hljs-number">0</span>,%eax
  <span class="hljs-attribute">400fb7</span>:	eb <span class="hljs-number">05</span>                	jmp    <span class="hljs-number">400</span>fbe &lt;phase_<span class="hljs-number">3</span>+<span class="hljs-number">0</span>x<span class="hljs-number">7</span>b&gt;
  <span class="hljs-attribute">400fb9</span>:	b<span class="hljs-number">8</span> <span class="hljs-number">37</span> <span class="hljs-number">01</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	mov    $<span class="hljs-number">0</span>x<span class="hljs-number">137</span>,%eax            # case <span class="hljs-number">2</span>: a = <span class="hljs-number">0</span>x<span class="hljs-number">137</span> = <span class="hljs-number">311</span>
  <span class="hljs-attribute">400fbe</span>:	<span class="hljs-number">3</span>b <span class="hljs-number">44</span> <span class="hljs-number">24</span> <span class="hljs-number">0</span>c          	cmp    <span class="hljs-number">0</span>xc(%rsp),%eax         # 总的来说，就是输入形如 <span class="hljs-string">&quot;x y&quot;</span>
  <span class="hljs-attribute">400fc2</span>:	<span class="hljs-number">74</span> <span class="hljs-number">05</span>                	je     <span class="hljs-number">400</span>fc<span class="hljs-number">9</span> &lt;phase_<span class="hljs-number">3</span>+<span class="hljs-number">0</span>x<span class="hljs-number">86</span>&gt;  # x 为 case, y 为 a, 
  <span class="hljs-attribute">400fc4</span>:	e<span class="hljs-number">8</span> <span class="hljs-number">71</span> <span class="hljs-number">04</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	callq  <span class="hljs-number">40143</span>a &lt;explode_bomb&gt;  # 比较 x 和 y 是否对应
  <span class="hljs-attribute">400fc9</span>:	<span class="hljs-number">48</span> <span class="hljs-number">83</span> c<span class="hljs-number">4</span> <span class="hljs-number">18</span>          	add    $<span class="hljs-number">0</span>x<span class="hljs-number">18</span>,%rsp
  <span class="hljs-attribute">400fcd</span>:	c<span class="hljs-number">3</span>                   	retq</code></pre>
<pre><code class="hljs perl">(gdb) <span class="hljs-keyword">x</span>/<span class="hljs-keyword">s</span> <span class="hljs-number">0x4025cf</span>
<span class="hljs-number">0x4025cf</span>:       <span class="hljs-string">&quot;%d %d&quot;</span></code></pre>
<p>两种方式查看跳转表</p>
<pre><code class="hljs angelscript">(gdb) x/<span class="hljs-number">8</span>xg <span class="hljs-number">0x402470</span>
<span class="hljs-number">0x402470</span>:       <span class="hljs-number">0x0000000000400f7c</span>      <span class="hljs-number">0x0000000000400fb9</span>
<span class="hljs-number">0x402480</span>:       <span class="hljs-number">0x0000000000400f83</span>      <span class="hljs-number">0x0000000000400f8a</span>
<span class="hljs-number">0x402490</span>:       <span class="hljs-number">0x0000000000400f91</span>      <span class="hljs-number">0x0000000000400f98</span>
<span class="hljs-number">0x4024a0</span>:       <span class="hljs-number">0x0000000000400f9f</span>      <span class="hljs-number">0x0000000000400fa6</span></code></pre>
<pre><code class="hljs angelscript"><span class="hljs-number">00002450</span>: <span class="hljs-number">73</span> <span class="hljs-number">65</span> <span class="hljs-number">63</span> <span class="hljs-number">72</span> <span class="hljs-number">65</span> <span class="hljs-number">74</span> <span class="hljs-number">20</span> <span class="hljs-number">73</span> <span class="hljs-number">74</span> <span class="hljs-number">61</span> <span class="hljs-number">67</span> <span class="hljs-number">65</span> <span class="hljs-number">21</span> <span class="hljs-number">00</span> <span class="hljs-number">66</span> <span class="hljs-number">6</span>C    secret.stage!.fl
<span class="hljs-number">00002460</span>: <span class="hljs-number">79</span> <span class="hljs-number">65</span> <span class="hljs-number">72</span> <span class="hljs-number">73</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>    yers............
<span class="hljs-number">00002470</span>: <span class="hljs-number">7</span>C <span class="hljs-number">0</span>F <span class="hljs-number">40</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> B9 <span class="hljs-number">0</span>F <span class="hljs-number">40</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>    |.@....<span class="hljs-number">.9</span>.@.....
<span class="hljs-number">00002480</span>: <span class="hljs-number">83</span> <span class="hljs-number">0</span>F <span class="hljs-number">40</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">8</span>A <span class="hljs-number">0</span>F <span class="hljs-number">40</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>    ..@.......@.....
<span class="hljs-number">00002490</span>: <span class="hljs-number">91</span> <span class="hljs-number">0</span>F <span class="hljs-number">40</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">98</span> <span class="hljs-number">0</span>F <span class="hljs-number">40</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>    ..@.......@.....
<span class="hljs-number">000024</span>a0: <span class="hljs-number">9</span>F <span class="hljs-number">0</span>F <span class="hljs-number">40</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> A6 <span class="hljs-number">0</span>F <span class="hljs-number">40</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>    ..@.....&amp;.@.....
<span class="hljs-number">000024</span>b0: <span class="hljs-number">6</span>D <span class="hljs-number">61</span> <span class="hljs-number">64</span> <span class="hljs-number">75</span> <span class="hljs-number">69</span> <span class="hljs-number">65</span> <span class="hljs-number">72</span> <span class="hljs-number">73</span> <span class="hljs-number">6</span>E <span class="hljs-number">66</span> <span class="hljs-number">6</span>F <span class="hljs-number">74</span> <span class="hljs-number">76</span> <span class="hljs-number">62</span> <span class="hljs-number">79</span> <span class="hljs-number">6</span>C    maduiersnfotvbyl
<span class="hljs-number">000024</span>c0: <span class="hljs-number">53</span> <span class="hljs-number">6</span>F <span class="hljs-number">20</span> <span class="hljs-number">79</span> <span class="hljs-number">6</span>F <span class="hljs-number">75</span> <span class="hljs-number">20</span> <span class="hljs-number">74</span> <span class="hljs-number">68</span> <span class="hljs-number">69</span> <span class="hljs-number">6</span>E <span class="hljs-number">6</span>B <span class="hljs-number">20</span> <span class="hljs-number">79</span> <span class="hljs-number">6</span>F <span class="hljs-number">75</span>    So.you.think.you</code></pre>
<p>由此得到的结论已经在注释里说明。答案任选其一即可</p>
<pre><code class="hljs basic"><span class="hljs-symbol">0 </span><span class="hljs-number">207</span>
<span class="hljs-symbol">1 </span><span class="hljs-number">311</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">707</span>
<span class="hljs-symbol">3 </span><span class="hljs-number">256</span>
<span class="hljs-symbol">4 </span><span class="hljs-number">389</span>
<span class="hljs-symbol">5 </span><span class="hljs-number">206</span>
<span class="hljs-symbol">6 </span><span class="hljs-number">682</span>
<span class="hljs-symbol">7 </span><span class="hljs-number">327</span></code></pre>
<h2 id="phase_4"><a class="markdownIt-Anchor" href="#phase_4"></a> phase_4</h2>
<p>定位到这一段，基本代码及说明如下</p>
<pre><code class="hljs apache"><span class="hljs-attribute">000000000040100c</span> &lt;phase_<span class="hljs-number">4</span>&gt;:
  <span class="hljs-attribute">40100c</span>:	<span class="hljs-number">48</span> <span class="hljs-number">83</span> ec <span class="hljs-number">18</span>          	sub    $<span class="hljs-number">0</span>x<span class="hljs-number">18</span>,%rsp
  <span class="hljs-attribute">401010</span>:	<span class="hljs-number">48</span> <span class="hljs-number">8</span>d <span class="hljs-number">4</span>c <span class="hljs-number">24</span> <span class="hljs-number">0</span>c       	lea    <span class="hljs-number">0</span>xc(%rsp),%rcx
  <span class="hljs-attribute">401015</span>:	<span class="hljs-number">48</span> <span class="hljs-number">8</span>d <span class="hljs-number">54</span> <span class="hljs-number">24</span> <span class="hljs-number">08</span>       	lea    <span class="hljs-number">0</span>x<span class="hljs-number">8</span>(%rsp),%rdx
  <span class="hljs-attribute">40101a</span>:	be cf <span class="hljs-number">25</span> <span class="hljs-number">40</span> <span class="hljs-number">00</span>       	mov    $<span class="hljs-number">0</span>x<span class="hljs-number">4025</span>cf,%esi # <span class="hljs-string">&quot;%d %d&quot;</span>
  <span class="hljs-attribute">40101f</span>:	b<span class="hljs-number">8</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	mov    $<span class="hljs-number">0</span>x<span class="hljs-number">0</span>,%eax      # sscanf(%rdi, <span class="hljs-string">&quot;%d %d&quot;</span>, <span class="hljs-number">0</span>x<span class="hljs-number">8</span>(%rsp), <span class="hljs-number">0</span>xc(%rsp))
  <span class="hljs-attribute">401024</span>:	e<span class="hljs-number">8</span> c<span class="hljs-number">7</span> fb ff ff       	callq  <span class="hljs-number">400</span>bf<span class="hljs-number">0</span> &lt;__isoc<span class="hljs-number">99</span>_sscanf@plt&gt;
  <span class="hljs-attribute">401029</span>:	<span class="hljs-number">83</span> f<span class="hljs-number">8</span> <span class="hljs-number">02</span>             	cmp    $<span class="hljs-number">0</span>x<span class="hljs-number">2</span>,%eax      # 返回值不为 <span class="hljs-number">2</span> 则 boom~~~
  <span class="hljs-attribute">40102c</span>:	<span class="hljs-number">75</span> <span class="hljs-number">07</span>                	jne    <span class="hljs-number">401035</span> &lt;phase_<span class="hljs-number">4</span>+<span class="hljs-number">0</span>x<span class="hljs-number">29</span>&gt;
  <span class="hljs-attribute">40102e</span>:	<span class="hljs-number">83</span> <span class="hljs-number">7</span>c <span class="hljs-number">24</span> <span class="hljs-number">08</span> <span class="hljs-number">0</span>e       	cmpl   $<span class="hljs-number">0</span>xe,<span class="hljs-number">0</span>x<span class="hljs-number">8</span>(%rsp)         # 第一个数字 &lt;= <span class="hljs-number">14</span> 则正常
  <span class="hljs-attribute">401033</span>:	<span class="hljs-number">76</span> <span class="hljs-number">05</span>                	jbe    <span class="hljs-number">40103</span>a &lt;phase_<span class="hljs-number">4</span>+<span class="hljs-number">0</span>x<span class="hljs-number">2</span>e&gt;
  <span class="hljs-attribute">401035</span>:	e<span class="hljs-number">8</span> <span class="hljs-number">00</span> <span class="hljs-number">04</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	callq  <span class="hljs-number">40143</span>a &lt;explode_bomb&gt;
  <span class="hljs-attribute">40103a</span>:	ba <span class="hljs-number">0</span>e <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	mov    $<span class="hljs-number">0</span>xe,%edx
  <span class="hljs-attribute">40103f</span>:	be <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	mov    $<span class="hljs-number">0</span>x<span class="hljs-number">0</span>,%esi
  <span class="hljs-attribute">401044</span>:	<span class="hljs-number">8</span>b <span class="hljs-number">7</span>c <span class="hljs-number">24</span> <span class="hljs-number">08</span>          	mov    <span class="hljs-number">0</span>x<span class="hljs-number">8</span>(%rsp),%edi
  <span class="hljs-attribute">401048</span>:	e<span class="hljs-number">8</span> <span class="hljs-number">81</span> ff ff ff       	callq  <span class="hljs-number">400</span>fce &lt;func<span class="hljs-number">4</span>&gt;         # func<span class="hljs-number">4</span>(<span class="hljs-number">0</span>x<span class="hljs-number">8</span>(%rsp), <span class="hljs-number">0</span>, <span class="hljs-number">14</span>)
  <span class="hljs-attribute">40104d</span>:	<span class="hljs-number">85</span> c<span class="hljs-number">0</span>                	test   %eax,%eax
  <span class="hljs-attribute">40104f</span>:	<span class="hljs-number">75</span> <span class="hljs-number">07</span>                	jne    <span class="hljs-number">401058</span> &lt;phase_<span class="hljs-number">4</span>+<span class="hljs-number">0</span>x<span class="hljs-number">4</span>c&gt;  # 返回值 == <span class="hljs-number">0</span> 则正常
  <span class="hljs-attribute">401051</span>:	<span class="hljs-number">83</span> <span class="hljs-number">7</span>c <span class="hljs-number">24</span> <span class="hljs-number">0</span>c <span class="hljs-number">00</span>       	cmpl   $<span class="hljs-number">0</span>x<span class="hljs-number">0</span>,<span class="hljs-number">0</span>xc(%rsp)         # 第二个数字 == <span class="hljs-number">0</span> 则正常
  <span class="hljs-attribute">401056</span>:	<span class="hljs-number">74</span> <span class="hljs-number">05</span>                	je     <span class="hljs-number">40105</span>d &lt;phase_<span class="hljs-number">4</span>+<span class="hljs-number">0</span>x<span class="hljs-number">51</span>&gt;
  <span class="hljs-attribute">401058</span>:	e<span class="hljs-number">8</span> dd <span class="hljs-number">03</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	callq  <span class="hljs-number">40143</span>a &lt;explode_bomb&gt;
  <span class="hljs-attribute">40105d</span>:	<span class="hljs-number">48</span> <span class="hljs-number">83</span> c<span class="hljs-number">4</span> <span class="hljs-number">18</span>          	add    $<span class="hljs-number">0</span>x<span class="hljs-number">18</span>,%rsp
  <span class="hljs-attribute">401061</span>:	c<span class="hljs-number">3</span>                   	retq</code></pre>
<p>再看一下 <code>func</code>，此处为 <code>func4(0x8(%rsp), 0, 14)</code></p>
<pre><code class="hljs apache"><span class="hljs-attribute">0000000000400fce</span> &lt;func<span class="hljs-number">4</span>&gt;:     # func(%edi, %esi, %edx), 记为 func(x, y, z), %eax 存 p, %ecx 存 q
  <span class="hljs-attribute">400fce</span>:	<span class="hljs-number">48</span> <span class="hljs-number">83</span> ec <span class="hljs-number">08</span>          	sub    $<span class="hljs-number">0</span>x<span class="hljs-number">8</span>,%rsp
  <span class="hljs-attribute">400fd2</span>:	<span class="hljs-number">89</span> d<span class="hljs-number">0</span>                	mov    %edx,%eax
  <span class="hljs-attribute">400fd4</span>:	<span class="hljs-number">29</span> f<span class="hljs-number">0</span>                	sub    %esi,%eax            # p = z - y
  <span class="hljs-attribute">400fd6</span>:	<span class="hljs-number">89</span> c<span class="hljs-number">1</span>                	mov    %eax,%ecx
  <span class="hljs-attribute">400fd8</span>:	c<span class="hljs-number">1</span> e<span class="hljs-number">9</span> <span class="hljs-number">1</span>f             	shr    $<span class="hljs-number">0</span>x<span class="hljs-number">1</span>f,%ecx           # q = (z - y) &gt;&gt; <span class="hljs-number">31</span>, 逻辑右移, 
  																<span class="hljs-comment"># z &gt;= y 为 1， z &lt; y 为 0</span>
  <span class="hljs-attribute">400fdb</span>:	<span class="hljs-number">01</span> c<span class="hljs-number">8</span>                	add    %ecx,%eax            # p = z - y + (z - y) &gt;&gt; <span class="hljs-number">31</span>
  <span class="hljs-attribute">400fdd</span>:	d<span class="hljs-number">1</span> f<span class="hljs-number">8</span>                	sar    %eax                 # p &gt;&gt;= <span class="hljs-number">1</span>, 算术右移
  <span class="hljs-attribute">400fdf</span>:	<span class="hljs-number">8</span>d <span class="hljs-number">0</span>c <span class="hljs-number">30</span>             	lea    (%rax,%rsi,<span class="hljs-number">1</span>),%ecx	# q = p + y
  <span class="hljs-attribute">400fe2</span>:	<span class="hljs-number">39</span> f<span class="hljs-number">9</span>                	cmp    %edi,%ecx            # q &lt;= x ?
  <span class="hljs-attribute">400fe4</span>:	<span class="hljs-number">7</span>e <span class="hljs-number">0</span>c                	jle    <span class="hljs-number">400</span>ff<span class="hljs-number">2</span> &lt;func<span class="hljs-number">4</span>+<span class="hljs-number">0</span>x<span class="hljs-number">24</span>&gt;  # q &lt;= x, 跳转
  <span class="hljs-attribute">400fe6</span>:	<span class="hljs-number">8</span>d <span class="hljs-number">51</span> ff             	lea    -<span class="hljs-number">0</span>x<span class="hljs-number">1</span>(%rcx),%edx      # q &gt; x, z = q - <span class="hljs-number">1</span>
  <span class="hljs-attribute">400fe9</span>:	e<span class="hljs-number">8</span> e<span class="hljs-number">0</span> ff ff ff       	callq  <span class="hljs-number">400</span>fce &lt;func<span class="hljs-number">4</span>&gt;       # func(%edi, %esi, %edx), 递归
  <span class="hljs-attribute">400fee</span>:	<span class="hljs-number">01</span> c<span class="hljs-number">0</span>                	add    %eax,%eax            # p = <span class="hljs-number">2</span>p
  <span class="hljs-attribute">400ff0</span>:	eb <span class="hljs-number">15</span>                	jmp    <span class="hljs-number">401007</span> &lt;func<span class="hljs-number">4</span>+<span class="hljs-number">0</span>x<span class="hljs-number">39</span>&gt;
  <span class="hljs-attribute">400ff2</span>:	b<span class="hljs-number">8</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	mov    $<span class="hljs-number">0</span>x<span class="hljs-number">0</span>,%eax            # p = <span class="hljs-number">0</span>
  <span class="hljs-attribute">400ff7</span>:	<span class="hljs-number">39</span> f<span class="hljs-number">9</span>                	cmp    %edi,%ecx            # q &gt;= x ?
  <span class="hljs-attribute">400ff9</span>:	<span class="hljs-number">7</span>d <span class="hljs-number">0</span>c                	jge    <span class="hljs-number">401007</span> &lt;func<span class="hljs-number">4</span>+<span class="hljs-number">0</span>x<span class="hljs-number">39</span>&gt;  # q &gt;= x, 跳转
  <span class="hljs-attribute">400ffb</span>:	<span class="hljs-number">8</span>d <span class="hljs-number">71</span> <span class="hljs-number">01</span>             	lea    <span class="hljs-number">0</span>x<span class="hljs-number">1</span>(%rcx),%esi       # q &lt; x, y = q + <span class="hljs-number">1</span>
  <span class="hljs-attribute">400ffe</span>:	e<span class="hljs-number">8</span> cb ff ff ff       	callq  <span class="hljs-number">400</span>fce &lt;func<span class="hljs-number">4</span>&gt;       # func(%edi, %esi, %edx), 递归
  <span class="hljs-attribute">401003</span>:	<span class="hljs-number">8</span>d <span class="hljs-number">44</span> <span class="hljs-number">00</span> <span class="hljs-number">01</span>          	lea    <span class="hljs-number">0</span>x<span class="hljs-number">1</span>(%rax,%rax,<span class="hljs-number">1</span>),%eax  # p = <span class="hljs-number">2</span>p + <span class="hljs-number">1</span>
  <span class="hljs-attribute">401007</span>:	<span class="hljs-number">48</span> <span class="hljs-number">83</span> c<span class="hljs-number">4</span> <span class="hljs-number">08</span>          	add    $<span class="hljs-number">0</span>x<span class="hljs-number">8</span>,%rsp
  <span class="hljs-attribute">40100b</span>:	c<span class="hljs-number">3</span>                   	retq</code></pre>
<p>虽然基本可以确定一个答案为  ，但<code>&lt;func4&gt;</code>还是让人有点懵，试图写一下它的 c 形式</p>
<pre><code class="hljs c"><span class="hljs-function"><span class="hljs-keyword">int</span> <span class="hljs-title">func4</span><span class="hljs-params">(<span class="hljs-keyword">int</span> x, <span class="hljs-keyword">int</span> y, <span class="hljs-keyword">int</span> z)</span></span>
<span class="hljs-function"></span>&#123;
    <span class="hljs-keyword">int</span> p = z - y;
    <span class="hljs-keyword">int</span> q = ((<span class="hljs-keyword">unsigned</span> <span class="hljs-keyword">int</span>)p) &gt;&gt; <span class="hljs-number">31</span>;
    p = (p + q) &gt;&gt; <span class="hljs-number">1</span>;
    q = p + y;
    <span class="hljs-keyword">if</span> (q &lt;= x) &#123;
        p = <span class="hljs-number">0</span>;
        <span class="hljs-keyword">if</span> (q &gt;= x)
            <span class="hljs-keyword">return</span> p;
        <span class="hljs-keyword">else</span> &#123;
            y = q + <span class="hljs-number">1</span>;
            p = func4(x, y, z);
            <span class="hljs-keyword">return</span> <span class="hljs-number">2</span> * p + <span class="hljs-number">1</span>;
        &#125;
    &#125; <span class="hljs-keyword">else</span> &#123;
        z = q - <span class="hljs-number">1</span>;
        p = func4(x, y, z);
        <span class="hljs-keyword">return</span> <span class="hljs-number">2</span> * p;
    &#125;
&#125;</code></pre>
<p>答案应该有多个，偷懒挑直接结束那个，反正 <code>7 0</code> 是一个答案。</p>
<h2 id="phase_5"><a class="markdownIt-Anchor" href="#phase_5"></a> phase_5</h2>
<p>定位到这一段，基本代码及说明如下</p>
<pre><code class="hljs apache"><span class="hljs-attribute">0000000000401062</span> &lt;phase_<span class="hljs-number">5</span>&gt;:
  <span class="hljs-attribute">401062</span>:	<span class="hljs-number">53</span>                   	push   %rbx
  <span class="hljs-attribute">401063</span>:	<span class="hljs-number">48</span> <span class="hljs-number">83</span> ec <span class="hljs-number">20</span>          	sub    $<span class="hljs-number">0</span>x<span class="hljs-number">20</span>,%rsp
  <span class="hljs-attribute">401067</span>:	<span class="hljs-number">48</span> <span class="hljs-number">89</span> fb             	mov    %rdi,%rbx                # 把参数放过来，目测是字符串
  <span class="hljs-attribute">40106a</span>:	<span class="hljs-number">64</span> <span class="hljs-number">48</span> <span class="hljs-number">8</span>b <span class="hljs-number">04</span> <span class="hljs-number">25</span> <span class="hljs-number">28</span> <span class="hljs-number">00</span> 	mov    %fs:<span class="hljs-number">0</span>x<span class="hljs-number">28</span>,%rax            # 用个金丝雀值来栈保护
  <span class="hljs-attribute">401071</span>:	<span class="hljs-number">00</span> <span class="hljs-number">00</span> 
  <span class="hljs-attribute">401073</span>:	<span class="hljs-number">48</span> <span class="hljs-number">89</span> <span class="hljs-number">44</span> <span class="hljs-number">24</span> <span class="hljs-number">18</span>       	mov    %rax,<span class="hljs-number">0</span>x<span class="hljs-number">18</span>(%rsp)          # 金丝雀值写到栈里面
  <span class="hljs-attribute">401078</span>:	<span class="hljs-number">31</span> c<span class="hljs-number">0</span>                	xor    %eax,%eax
  <span class="hljs-attribute">40107a</span>:	e<span class="hljs-number">8</span> <span class="hljs-number">9</span>c <span class="hljs-number">02</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	callq  <span class="hljs-number">40131</span>b &lt;string_length&gt;   # string_length(char* %rdi)
  <span class="hljs-attribute">40107f</span>:	<span class="hljs-number">83</span> f<span class="hljs-number">8</span> <span class="hljs-number">06</span>             	cmp    $<span class="hljs-number">0</span>x<span class="hljs-number">6</span>,%eax                # 字符串长度 <span class="hljs-number">6</span> 则 boom~~~
  <span class="hljs-attribute">401082</span>:	<span class="hljs-number">74</span> <span class="hljs-number">4</span>e                	je     <span class="hljs-number">4010</span>d<span class="hljs-number">2</span> &lt;phase_<span class="hljs-number">5</span>+<span class="hljs-number">0</span>x<span class="hljs-number">70</span>&gt;
  <span class="hljs-attribute">401084</span>:	e<span class="hljs-number">8</span> b<span class="hljs-number">1</span> <span class="hljs-number">03</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	callq  <span class="hljs-number">40143</span>a &lt;explode_bomb&gt;
  <span class="hljs-attribute">401089</span>:	eb <span class="hljs-number">47</span>                	jmp    <span class="hljs-number">4010</span>d<span class="hljs-number">2</span> &lt;phase_<span class="hljs-number">5</span>+<span class="hljs-number">0</span>x<span class="hljs-number">70</span>&gt;
  <span class="hljs-attribute">40108b</span>:	<span class="hljs-number">0</span>f b<span class="hljs-number">6</span> <span class="hljs-number">0</span>c <span class="hljs-number">03</span>          	movzbl (%rbx,%rax,<span class="hljs-number">1</span>),%ecx       # %ecx 任然初始为开始的字符串
  <span class="hljs-attribute">40108f</span>:	<span class="hljs-number">88</span> <span class="hljs-number">0</span>c <span class="hljs-number">24</span>             	mov    %cl,(%rsp)
  <span class="hljs-attribute">401092</span>:	<span class="hljs-number">48</span> <span class="hljs-number">8</span>b <span class="hljs-number">14</span> <span class="hljs-number">24</span>          	mov    (%rsp),%rdx
  <span class="hljs-attribute">401096</span>:	<span class="hljs-number">83</span> e<span class="hljs-number">2</span> <span class="hljs-number">0</span>f             	and    $<span class="hljs-number">0</span>xf,%edx                # 从 %ecx 取出低 <span class="hljs-number">4</span> 位到 %dl
  <span class="hljs-attribute">401099</span>:	<span class="hljs-number">0</span>f b<span class="hljs-number">6</span> <span class="hljs-number">92</span> b<span class="hljs-number">0</span> <span class="hljs-number">24</span> <span class="hljs-number">40</span> <span class="hljs-number">00</span> 	movzbl <span class="hljs-number">0</span>x<span class="hljs-number">4024</span>b<span class="hljs-number">0</span>(%rdx),%edx      # 依据 %dl 从 char[<span class="hljs-number">16</span>] maduiersnfotvbyl 中取值到 %dl
  <span class="hljs-attribute">4010a0</span>:	<span class="hljs-number">88</span> <span class="hljs-number">54</span> <span class="hljs-number">04</span> <span class="hljs-number">10</span>          	mov    %dl,<span class="hljs-number">0</span>x<span class="hljs-number">10</span>(%rsp,%rax,<span class="hljs-number">1</span>)    # 保存到栈里面
  <span class="hljs-attribute">4010a4</span>:	<span class="hljs-number">48</span> <span class="hljs-number">83</span> c<span class="hljs-number">0</span> <span class="hljs-number">01</span>          	add    $<span class="hljs-number">0</span>x<span class="hljs-number">1</span>,%rax
  <span class="hljs-attribute">4010a8</span>:	<span class="hljs-number">48</span> <span class="hljs-number">83</span> f<span class="hljs-number">8</span> <span class="hljs-number">06</span>          	cmp    $<span class="hljs-number">0</span>x<span class="hljs-number">6</span>,%rax                # 循环 <span class="hljs-number">6</span> 次
  <span class="hljs-attribute">4010ac</span>:	<span class="hljs-number">75</span> dd                	jne    <span class="hljs-number">40108</span>b &lt;phase_<span class="hljs-number">5</span>+<span class="hljs-number">0</span>x<span class="hljs-number">29</span>&gt;
  <span class="hljs-attribute">4010ae</span>:	c<span class="hljs-number">6</span> <span class="hljs-number">44</span> <span class="hljs-number">24</span> <span class="hljs-number">16</span> <span class="hljs-number">00</span>       	movb   $<span class="hljs-number">0</span>x<span class="hljs-number">0</span>,<span class="hljs-number">0</span>x<span class="hljs-number">16</span>(%rsp)          # 给前面取出的字符串后面添上 <span class="hljs-number">0</span>
  <span class="hljs-attribute">4010b3</span>:	be <span class="hljs-number">5</span>e <span class="hljs-number">24</span> <span class="hljs-number">40</span> <span class="hljs-number">00</span>       	mov    $<span class="hljs-number">0</span>x<span class="hljs-number">40245</span>e,%esi           
  <span class="hljs-attribute">4010b8</span>:	<span class="hljs-number">48</span> <span class="hljs-number">8</span>d <span class="hljs-number">7</span>c <span class="hljs-number">24</span> <span class="hljs-number">10</span>       	lea    <span class="hljs-number">0</span>x<span class="hljs-number">10</span>(%rsp),%rdi
  <span class="hljs-attribute">4010bd</span>:	e<span class="hljs-number">8</span> <span class="hljs-number">76</span> <span class="hljs-number">02</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	callq  <span class="hljs-number">401338</span> &lt;strings_not_equal&gt; # 比较 <span class="hljs-string">&quot;flyers&quot;</span> 和 <span class="hljs-number">0</span>x<span class="hljs-number">10</span>(%rsp) ~ <span class="hljs-number">0</span>x<span class="hljs-number">15</span>(%rsp) 是否相等
  <span class="hljs-attribute">4010c2</span>:	<span class="hljs-number">85</span> c<span class="hljs-number">0</span>                	test   %eax,%eax
  <span class="hljs-attribute">4010c4</span>:	<span class="hljs-number">74</span> <span class="hljs-number">13</span>                	je     <span class="hljs-number">4010</span>d<span class="hljs-number">9</span> &lt;phase_<span class="hljs-number">5</span>+<span class="hljs-number">0</span>x<span class="hljs-number">77</span>&gt;    # <span class="hljs-number">0</span> 相等 
  <span class="hljs-attribute">4010c6</span>:	e<span class="hljs-number">8</span> <span class="hljs-number">6</span>f <span class="hljs-number">03</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	callq  <span class="hljs-number">40143</span>a &lt;explode_bomb&gt;    # <span class="hljs-number">1</span> 爆炸
  <span class="hljs-attribute">4010cb</span>:	<span class="hljs-number">0</span>f <span class="hljs-number">1</span>f <span class="hljs-number">44</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	nopl   <span class="hljs-number">0</span>x<span class="hljs-number">0</span>(%rax,%rax,<span class="hljs-number">1</span>)
  <span class="hljs-attribute">4010d0</span>:	eb <span class="hljs-number">07</span>                	jmp    <span class="hljs-number">4010</span>d<span class="hljs-number">9</span> &lt;phase_<span class="hljs-number">5</span>+<span class="hljs-number">0</span>x<span class="hljs-number">77</span>&gt;
  <span class="hljs-attribute">4010d2</span>:	b<span class="hljs-number">8</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	mov    $<span class="hljs-number">0</span>x<span class="hljs-number">0</span>,%eax                # %eax 初始为 <span class="hljs-number">0</span>
  <span class="hljs-attribute">4010d7</span>:	eb b<span class="hljs-number">2</span>                	jmp    <span class="hljs-number">40108</span>b &lt;phase_<span class="hljs-number">5</span>+<span class="hljs-number">0</span>x<span class="hljs-number">29</span>&gt;
  <span class="hljs-attribute">4010d9</span>:	<span class="hljs-number">48</span> <span class="hljs-number">8</span>b <span class="hljs-number">44</span> <span class="hljs-number">24</span> <span class="hljs-number">18</span>       	mov    <span class="hljs-number">0</span>x<span class="hljs-number">18</span>(%rsp),%rax          # 取出栈中金丝雀值
  <span class="hljs-attribute">4010de</span>:	<span class="hljs-number">64</span> <span class="hljs-number">48</span> <span class="hljs-number">33</span> <span class="hljs-number">04</span> <span class="hljs-number">25</span> <span class="hljs-number">28</span> <span class="hljs-number">00</span> 	xor    %fs:<span class="hljs-number">0</span>x<span class="hljs-number">28</span>,%rax            # 检查金丝雀值
  <span class="hljs-attribute">4010e5</span>:	<span class="hljs-number">00</span> <span class="hljs-number">00</span> 
  <span class="hljs-attribute">4010e7</span>:	<span class="hljs-number">74</span> <span class="hljs-number">05</span>                	je     <span class="hljs-number">4010</span>ee &lt;phase_<span class="hljs-number">5</span>+<span class="hljs-number">0</span>x<span class="hljs-number">8</span>c&gt;
  <span class="hljs-attribute">4010e9</span>:	e<span class="hljs-number">8</span> <span class="hljs-number">42</span> fa ff ff       	callq  <span class="hljs-number">400</span>b<span class="hljs-number">30</span> &lt;__stack_chk_fail@plt&gt;  # 栈被破坏
  <span class="hljs-attribute">4010ee</span>:	<span class="hljs-number">48</span> <span class="hljs-number">83</span> c<span class="hljs-number">4</span> <span class="hljs-number">20</span>          	add    $<span class="hljs-number">0</span>x<span class="hljs-number">20</span>,%rsp
  <span class="hljs-attribute">4010f2</span>:	<span class="hljs-number">5</span>b                   	pop    %rbx
  <span class="hljs-attribute">4010f3</span>:	c<span class="hljs-number">3</span>                   	retq</code></pre>
<pre><code class="hljs angelscript"><span class="hljs-number">000000000040131</span>b &lt;<span class="hljs-built_in">string</span>_length&gt;:
  <span class="hljs-number">40131</span>b:	<span class="hljs-number">80</span> <span class="hljs-number">3f</span> <span class="hljs-number">00</span>             	cmpb   $<span class="hljs-number">0x0</span>,(%rdi)
  <span class="hljs-number">40131</span>e:	<span class="hljs-number">74</span> <span class="hljs-number">12</span>                	je     <span class="hljs-number">401332</span> &lt;<span class="hljs-built_in">string</span>_length+<span class="hljs-number">0x17</span>&gt;
  <span class="hljs-number">401320</span>:	<span class="hljs-number">48</span> <span class="hljs-number">89</span> fa             	mov    %rdi,%rdx
  <span class="hljs-number">401323</span>:	<span class="hljs-number">48</span> <span class="hljs-number">83</span> c2 <span class="hljs-number">01</span>          	add    $<span class="hljs-number">0x1</span>,%rdx
  <span class="hljs-number">401327</span>:	<span class="hljs-number">89</span> d0                	mov    %edx,%eax
  <span class="hljs-number">401329</span>:	<span class="hljs-number">29</span> f8                	sub    %edi,%eax
  <span class="hljs-number">40132</span>b:	<span class="hljs-number">80</span> <span class="hljs-number">3</span>a <span class="hljs-number">00</span>             	cmpb   $<span class="hljs-number">0x0</span>,(%rdx)
  <span class="hljs-number">40132</span>e:	<span class="hljs-number">75</span> f3                	jne    <span class="hljs-number">401323</span> &lt;<span class="hljs-built_in">string</span>_length+<span class="hljs-number">0x8</span>&gt;
  <span class="hljs-number">401330</span>:	f3 c3                	repz retq 
  <span class="hljs-number">401332</span>:	b8 <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	mov    $<span class="hljs-number">0x0</span>,%eax
  <span class="hljs-number">401337</span>:	c3                   	retq</code></pre>
<p>查看里面的几个地址</p>
<pre><code class="hljs angelscript">(gdb) x/s <span class="hljs-number">0x4024b0</span>
<span class="hljs-number">0x4024b0</span> &lt;<span class="hljs-built_in">array</span><span class="hljs-number">.3449</span>&gt;:  <span class="hljs-string">&quot;maduiersnfotvbylSo you think you can stop the bomb with ctrl-c, do you?&quot;</span>
(gdb) x/s <span class="hljs-number">0x40245e</span>
<span class="hljs-number">0x40245e</span>:       <span class="hljs-string">&quot;flyers&quot;</span></code></pre>
<pre><code class="hljs angelscript"><span class="hljs-number">000024</span>b0: <span class="hljs-number">6</span>D <span class="hljs-number">61</span> <span class="hljs-number">64</span> <span class="hljs-number">75</span> <span class="hljs-number">69</span> <span class="hljs-number">65</span> <span class="hljs-number">72</span> <span class="hljs-number">73</span> <span class="hljs-number">6</span>E <span class="hljs-number">66</span> <span class="hljs-number">6</span>F <span class="hljs-number">74</span> <span class="hljs-number">76</span> <span class="hljs-number">62</span> <span class="hljs-number">79</span> <span class="hljs-number">6</span>C    maduiersnfotvbyl

<span class="hljs-number">00002450</span>: <span class="hljs-number">73</span> <span class="hljs-number">65</span> <span class="hljs-number">63</span> <span class="hljs-number">72</span> <span class="hljs-number">65</span> <span class="hljs-number">74</span> <span class="hljs-number">20</span> <span class="hljs-number">73</span> <span class="hljs-number">74</span> <span class="hljs-number">61</span> <span class="hljs-number">67</span> <span class="hljs-number">65</span> <span class="hljs-number">21</span> <span class="hljs-number">00</span> <span class="hljs-number">66</span> <span class="hljs-number">6</span>C    secret.stage!.fl
<span class="hljs-number">00002460</span>: <span class="hljs-number">79</span> <span class="hljs-number">65</span> <span class="hljs-number">72</span> <span class="hljs-number">73</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>    yers............</code></pre>
<p>可以判断 <code>0x4024b0</code>里面是一个<code>char[16]</code>的数组，记为为<code>char* a</code>，输入的字符串需要保证，按照每个字符的最低 4 位依次取出的字符等于 “flyers”，列出下表一部分，举个例子，其他的自行查看 ASCII 表组合即可，给出一个答案：<code>9ON567</code></p>
<table>
<thead>
<tr>
<th>a[i] = c</th>
<th>x : x &amp; 0xf == i</th>
<th>a[i] = c</th>
<th>x : x &amp; 0xf == i</th>
<th>a[i] = c</th>
<th>x : x &amp; 0xf == i</th>
<th>a[i] = c</th>
<th>x : x &amp; 0xf == i</th>
</tr>
</thead>
<tbody>
<tr>
<td>a[0] = m</td>
<td>’ ‘, 0, @, P, \’, p</td>
<td>a[4] = i</td>
<td></td>
<td>a[8]   = n</td>
<td></td>
<td>a[12] = v</td>
<td></td>
</tr>
<tr>
<td>a[1] = a</td>
<td>!, 1, A, Q, a, q</td>
<td>a[5] = e</td>
<td></td>
<td>a[9]  = f</td>
<td></td>
<td>a[13] = b</td>
<td></td>
</tr>
<tr>
<td>a[2] = d</td>
<td></td>
<td>a[6] = r</td>
<td></td>
<td>a[10] = o</td>
<td></td>
<td>a[14] = y</td>
<td></td>
</tr>
<tr>
<td>a[3] = u</td>
<td></td>
<td>a[7] = s</td>
<td></td>
<td>a[11] = t</td>
<td></td>
<td>a[15] = l</td>
<td></td>
</tr>
</tbody>
</table>
<h2 id="phase_6"><a class="markdownIt-Anchor" href="#phase_6"></a> phase_6</h2>
<p>这一段有点混乱，最难的是中间部分按照数组每个数的值来确定链表顺序</p>
<pre><code class="hljs apache"><span class="hljs-attribute">00000000004010f4</span> &lt;phase_<span class="hljs-number">6</span>&gt;:
  <span class="hljs-attribute">4010f4</span>:	<span class="hljs-number">41</span> <span class="hljs-number">56</span>                	push   %r<span class="hljs-number">14</span>
  <span class="hljs-attribute">4010f6</span>:	<span class="hljs-number">41</span> <span class="hljs-number">55</span>                	push   %r<span class="hljs-number">13</span>
  <span class="hljs-attribute">4010f8</span>:	<span class="hljs-number">41</span> <span class="hljs-number">54</span>                	push   %r<span class="hljs-number">12</span>
  <span class="hljs-attribute">4010fa</span>:	<span class="hljs-number">55</span>                   	push   %rbp
  <span class="hljs-attribute">4010fb</span>:	<span class="hljs-number">53</span>                   	push   %rbx
  <span class="hljs-attribute">4010fc</span>:	<span class="hljs-number">48</span> <span class="hljs-number">83</span> ec <span class="hljs-number">50</span>          	sub    $<span class="hljs-number">0</span>x<span class="hljs-number">50</span>,%rsp
  <span class="hljs-attribute">401100</span>:	<span class="hljs-number">49</span> <span class="hljs-number">89</span> e<span class="hljs-number">5</span>             	mov    %rsp,%r<span class="hljs-number">13</span>  # 保存一份 %rsp 在 %r<span class="hljs-number">13</span> 中
  <span class="hljs-attribute">401103</span>:	<span class="hljs-number">48</span> <span class="hljs-number">89</span> e<span class="hljs-number">6</span>             	mov    %rsp,%rsi  # 结果在 <span class="hljs-number">0</span>x<span class="hljs-number">0</span>(%rsp) ... <span class="hljs-number">0</span>x<span class="hljs-number">14</span>(%rsp) 中
  <span class="hljs-attribute">401106</span>:	e<span class="hljs-number">8</span> <span class="hljs-number">51</span> <span class="hljs-number">03</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	callq  <span class="hljs-number">40145</span>c &lt;read_six_numbers&gt;  # 记为 int sn[<span class="hljs-number">6</span>]
  <span class="hljs-attribute">40110b</span>:	<span class="hljs-number">49</span> <span class="hljs-number">89</span> e<span class="hljs-number">6</span>             	mov    %rsp,%r<span class="hljs-number">14</span>  # 保存
  <span class="hljs-attribute">40110e</span>:	<span class="hljs-number">41</span> bc <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>    	mov    $<span class="hljs-number">0</span>x<span class="hljs-number">0</span>,%r<span class="hljs-number">12</span>d       # 初始化循环变量 i=<span class="hljs-number">0</span>
  <span class="hljs-attribute">401114</span>:	<span class="hljs-number">4</span>c <span class="hljs-number">89</span> ed             	mov    %r<span class="hljs-number">13</span>,%rbp        # -----此行及以下为大循环-------
  <span class="hljs-attribute">401117</span>:	<span class="hljs-number">41</span> <span class="hljs-number">8</span>b <span class="hljs-number">45</span> <span class="hljs-number">00</span>          	mov    <span class="hljs-number">0</span>x<span class="hljs-number">0</span>(%r<span class="hljs-number">13</span>),%eax   # sn[i] 需要 &lt;= <span class="hljs-number">6</span>
  <span class="hljs-attribute">40111b</span>:	<span class="hljs-number">83</span> e<span class="hljs-number">8</span> <span class="hljs-number">01</span>             	sub    $<span class="hljs-number">0</span>x<span class="hljs-number">1</span>,%eax        # %eax -= <span class="hljs-number">1</span>
  <span class="hljs-attribute">40111e</span>:	<span class="hljs-number">83</span> f<span class="hljs-number">8</span> <span class="hljs-number">05</span>             	cmp    $<span class="hljs-number">0</span>x<span class="hljs-number">5</span>,%eax        # %eax &lt;= <span class="hljs-number">5</span> 正常，否则爆炸
  <span class="hljs-attribute">401121</span>:	<span class="hljs-number">76</span> <span class="hljs-number">05</span>                	jbe    <span class="hljs-number">401128</span> &lt;phase_<span class="hljs-number">6</span>+<span class="hljs-number">0</span>x<span class="hljs-number">34</span>&gt;
  <span class="hljs-attribute">401123</span>:	e<span class="hljs-number">8</span> <span class="hljs-number">12</span> <span class="hljs-number">03</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	callq  <span class="hljs-number">40143</span>a &lt;explode_bomb&gt;
  <span class="hljs-attribute">401128</span>:	<span class="hljs-number">41</span> <span class="hljs-number">83</span> c<span class="hljs-number">4</span> <span class="hljs-number">01</span>          	add    $<span class="hljs-number">0</span>x<span class="hljs-number">1</span>,%r<span class="hljs-number">12</span>d       # <span class="hljs-number">0</span>-&gt;<span class="hljs-number">1</span>-&gt;<span class="hljs-number">2</span> ... <span class="hljs-number">6</span>
  <span class="hljs-attribute">40112c</span>:	<span class="hljs-number">41</span> <span class="hljs-number">83</span> fc <span class="hljs-number">06</span>          	cmp    $<span class="hljs-number">0</span>x<span class="hljs-number">6</span>,%r<span class="hljs-number">12</span>d       # 循环<span class="hljs-number">6</span>次
  <span class="hljs-attribute">401130</span>:	<span class="hljs-number">74</span> <span class="hljs-number">21</span>                	je     <span class="hljs-number">401153</span> &lt;phase_<span class="hljs-number">6</span>+<span class="hljs-number">0</span>x<span class="hljs-number">5</span>f&gt;
  <span class="hljs-attribute">401132</span>:	<span class="hljs-number">44</span> <span class="hljs-number">89</span> e<span class="hljs-number">3</span>             	mov    %r<span class="hljs-number">12</span>d,%ebx       # 初始化循环变量 j = i
  <span class="hljs-attribute">401135</span>:	<span class="hljs-number">48</span> <span class="hljs-number">63</span> c<span class="hljs-number">3</span>             	movslq %ebx,%rax        # -----此行及以下为小循环-------
  <span class="hljs-attribute">401138</span>:	<span class="hljs-number">8</span>b <span class="hljs-number">04</span> <span class="hljs-number">84</span>             	mov    (%rsp,%rax,<span class="hljs-number">4</span>),%eax     # sn[i] != sn[j], j&gt;=i 才行
  <span class="hljs-attribute">40113b</span>:	<span class="hljs-number">39</span> <span class="hljs-number">45</span> <span class="hljs-number">00</span>             	cmp    %eax,<span class="hljs-number">0</span>x<span class="hljs-number">0</span>(%rbp)         # (%rsp + <span class="hljs-number">4</span>j) == sn[i] ?
  <span class="hljs-attribute">40113e</span>:	<span class="hljs-number">75</span> <span class="hljs-number">05</span>                	jne    <span class="hljs-number">401145</span> &lt;phase_<span class="hljs-number">6</span>+<span class="hljs-number">0</span>x<span class="hljs-number">51</span>&gt;  # 不相等正常，跳一行
  <span class="hljs-attribute">401140</span>:	e<span class="hljs-number">8</span> f<span class="hljs-number">5</span> <span class="hljs-number">02</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	callq  <span class="hljs-number">40143</span>a &lt;explode_bomb&gt;  # 相等爆炸
  <span class="hljs-attribute">401145</span>:	<span class="hljs-number">83</span> c<span class="hljs-number">3</span> <span class="hljs-number">01</span>             	add    $<span class="hljs-number">0</span>x<span class="hljs-number">1</span>,%ebx              # %r<span class="hljs-number">12</span>d ... <span class="hljs-number">5</span>
  <span class="hljs-attribute">401148</span>:	<span class="hljs-number">83</span> fb <span class="hljs-number">05</span>             	cmp    $<span class="hljs-number">0</span>x<span class="hljs-number">5</span>,%ebx              # 循环
  <span class="hljs-attribute">40114b</span>:	<span class="hljs-number">7</span>e e<span class="hljs-number">8</span>                	jle    <span class="hljs-number">401135</span> &lt;phase_<span class="hljs-number">6</span>+<span class="hljs-number">0</span>x<span class="hljs-number">41</span>&gt;
  <span class="hljs-attribute">40114d</span>:	<span class="hljs-number">49</span> <span class="hljs-number">83</span> c<span class="hljs-number">5</span> <span class="hljs-number">04</span>          	add    $<span class="hljs-number">0</span>x<span class="hljs-number">4</span>,%r<span class="hljs-number">13</span>              # 每次加 <span class="hljs-number">4</span>, 一个 int
  <span class="hljs-attribute">401151</span>:	eb c<span class="hljs-number">1</span>                	jmp    <span class="hljs-number">401114</span> &lt;phase_<span class="hljs-number">6</span>+<span class="hljs-number">0</span>x<span class="hljs-number">20</span>&gt;  # ------------------ end
  <span class="hljs-attribute">401153</span>:	<span class="hljs-number">48</span> <span class="hljs-number">8</span>d <span class="hljs-number">74</span> <span class="hljs-number">24</span> <span class="hljs-number">18</span>       	lea    <span class="hljs-number">0</span>x<span class="hljs-number">18</span>(%rsp),%rsi        # ---又一个循环-----
  <span class="hljs-attribute">401158</span>:	<span class="hljs-number">4</span>c <span class="hljs-number">89</span> f<span class="hljs-number">0</span>             	mov    %r<span class="hljs-number">14</span>,%rax
  <span class="hljs-attribute">40115b</span>:	b<span class="hljs-number">9</span> <span class="hljs-number">07</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	mov    $<span class="hljs-number">0</span>x<span class="hljs-number">7</span>,%ecx
  <span class="hljs-attribute">401160</span>:	<span class="hljs-number">89</span> ca                	mov    %ecx,%edx
  <span class="hljs-attribute">401162</span>:	<span class="hljs-number">2</span>b <span class="hljs-number">10</span>                	sub    (%rax),%edx            # <span class="hljs-number">7</span> - sn[i]
  <span class="hljs-attribute">401164</span>:	<span class="hljs-number">89</span> <span class="hljs-number">10</span>                	mov    %edx,(%rax)            # sn[i] = <span class="hljs-number">7</span> - sn[i]
  <span class="hljs-attribute">401166</span>:	<span class="hljs-number">48</span> <span class="hljs-number">83</span> c<span class="hljs-number">0</span> <span class="hljs-number">04</span>          	add    $<span class="hljs-number">0</span>x<span class="hljs-number">4</span>,%rax              # i += <span class="hljs-number">4</span>
  <span class="hljs-attribute">40116a</span>:	<span class="hljs-number">48</span> <span class="hljs-number">39</span> f<span class="hljs-number">0</span>             	cmp    %rsi,%rax
  <span class="hljs-attribute">40116d</span>:	<span class="hljs-number">75</span> f<span class="hljs-number">1</span>                	jne    <span class="hljs-number">401160</span> &lt;phase_<span class="hljs-number">6</span>+<span class="hljs-number">0</span>x<span class="hljs-number">6</span>c&gt;  # ------------------ end
  <span class="hljs-attribute">40116f</span>:	be <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	mov    $<span class="hljs-number">0</span>x<span class="hljs-number">0</span>,%esi              # 循环变量初始化, i=<span class="hljs-number">0</span>
  <span class="hljs-attribute">401174</span>:	eb <span class="hljs-number">21</span>                	jmp    <span class="hljs-number">401197</span> &lt;phase_<span class="hljs-number">6</span>+<span class="hljs-number">0</span>xa<span class="hljs-number">3</span>&gt;
  <span class="hljs-attribute">401176</span>:	<span class="hljs-number">48</span> <span class="hljs-number">8</span>b <span class="hljs-number">52</span> <span class="hljs-number">08</span>          	mov    <span class="hljs-number">0</span>x<span class="hljs-number">8</span>(%rdx),%rdx         # ---目测是 next 指针---
  <span class="hljs-attribute">40117a</span>:	<span class="hljs-number">83</span> c<span class="hljs-number">0</span> <span class="hljs-number">01</span>             	add    $<span class="hljs-number">0</span>x<span class="hljs-number">1</span>,%eax              # 这里是个小循环
  <span class="hljs-attribute">40117d</span>:	<span class="hljs-number">39</span> c<span class="hljs-number">8</span>                	cmp    %ecx,%eax              # sn[i] = k 对应 node k
  <span class="hljs-attribute">40117f</span>:	<span class="hljs-number">75</span> f<span class="hljs-number">5</span>                	jne    <span class="hljs-number">401176</span> &lt;phase_<span class="hljs-number">6</span>+<span class="hljs-number">0</span>x<span class="hljs-number">82</span>&gt;  # ------------------ end
  <span class="hljs-attribute">401181</span>:	eb <span class="hljs-number">05</span>                	jmp    <span class="hljs-number">401188</span> &lt;phase_<span class="hljs-number">6</span>+<span class="hljs-number">0</span>x<span class="hljs-number">94</span>&gt;
  <span class="hljs-attribute">401183</span>:	ba d<span class="hljs-number">0</span> <span class="hljs-number">32</span> <span class="hljs-number">60</span> <span class="hljs-number">00</span>       	mov    $<span class="hljs-number">0</span>x<span class="hljs-number">6032</span>d<span class="hljs-number">0</span>,%edx         # ---存一堆long的循环----
  <span class="hljs-attribute">401188</span>:	<span class="hljs-number">48</span> <span class="hljs-number">89</span> <span class="hljs-number">54</span> <span class="hljs-number">74</span> <span class="hljs-number">20</span>       	mov    %rdx,<span class="hljs-number">0</span>x<span class="hljs-number">20</span>(%rsp,%rsi,<span class="hljs-number">2</span>) # <span class="hljs-number">0</span>x<span class="hljs-number">20</span>(%rsp) ... <span class="hljs-number">0</span>x<span class="hljs-number">48</span>(%rsp)
  <span class="hljs-attribute">40118d</span>:	<span class="hljs-number">48</span> <span class="hljs-number">83</span> c<span class="hljs-number">6</span> <span class="hljs-number">04</span>          	add    $<span class="hljs-number">0</span>x<span class="hljs-number">4</span>,%rsi              # %rsi = <span class="hljs-number">0</span>, <span class="hljs-number">4</span>, ... <span class="hljs-number">24</span>
  <span class="hljs-attribute">401191</span>:	<span class="hljs-number">48</span> <span class="hljs-number">83</span> fe <span class="hljs-number">18</span>          	cmp    $<span class="hljs-number">0</span>x<span class="hljs-number">18</span>,%rsi
  <span class="hljs-attribute">401195</span>:	<span class="hljs-number">74</span> <span class="hljs-number">14</span>                	je     <span class="hljs-number">4011</span>ab &lt;phase_<span class="hljs-number">6</span>+<span class="hljs-number">0</span>xb<span class="hljs-number">7</span>&gt;
  <span class="hljs-attribute">401197</span>:	<span class="hljs-number">8</span>b <span class="hljs-number">0</span>c <span class="hljs-number">34</span>             	mov    (%rsp,%rsi,<span class="hljs-number">1</span>),%ecx     # %ecx = sn[i] &lt;= <span class="hljs-number">1</span> ?
  <span class="hljs-attribute">40119a</span>:	<span class="hljs-number">83</span> f<span class="hljs-number">9</span> <span class="hljs-number">01</span>             	cmp    $<span class="hljs-number">0</span>x<span class="hljs-number">1</span>,%ecx              # 
  <span class="hljs-attribute">40119d</span>:	<span class="hljs-number">7</span>e e<span class="hljs-number">4</span>                	jle    <span class="hljs-number">401183</span> &lt;phase_<span class="hljs-number">6</span>+<span class="hljs-number">0</span>x<span class="hljs-number">8</span>f&gt;  # ----------------------
  <span class="hljs-attribute">40119f</span>:	b<span class="hljs-number">8</span> <span class="hljs-number">01</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	mov    $<span class="hljs-number">0</span>x<span class="hljs-number">1</span>,%eax
  <span class="hljs-attribute">4011a4</span>:	ba d<span class="hljs-number">0</span> <span class="hljs-number">32</span> <span class="hljs-number">60</span> <span class="hljs-number">00</span>       	mov    $<span class="hljs-number">0</span>x<span class="hljs-number">6032</span>d<span class="hljs-number">0</span>,%edx         # 
  <span class="hljs-attribute">4011a9</span>:	eb cb                	jmp    <span class="hljs-number">401176</span> &lt;phase_<span class="hljs-number">6</span>+<span class="hljs-number">0</span>x<span class="hljs-number">82</span>&gt;  
  <span class="hljs-attribute">4011ab</span>:	<span class="hljs-number">48</span> <span class="hljs-number">8</span>b <span class="hljs-number">5</span>c <span class="hljs-number">24</span> <span class="hljs-number">20</span>       	mov    <span class="hljs-number">0</span>x<span class="hljs-number">20</span>(%rsp),%rbx        # 保存，相当于 head(nn) (val)
  <span class="hljs-attribute">4011b0</span>:	<span class="hljs-number">48</span> <span class="hljs-number">8</span>d <span class="hljs-number">44</span> <span class="hljs-number">24</span> <span class="hljs-number">28</span>       	lea    <span class="hljs-number">0</span>x<span class="hljs-number">28</span>(%rsp),%rax        # nn-&gt;next (addr)
  <span class="hljs-attribute">4011b5</span>:	<span class="hljs-number">48</span> <span class="hljs-number">8</span>d <span class="hljs-number">74</span> <span class="hljs-number">24</span> <span class="hljs-number">50</span>       	lea    <span class="hljs-number">0</span>x<span class="hljs-number">50</span>(%rsp),%rsi        # tail(nn) (addr)
  <span class="hljs-attribute">4011ba</span>:	<span class="hljs-number">48</span> <span class="hljs-number">89</span> d<span class="hljs-number">9</span>             	mov    %rbx,%rcx
  <span class="hljs-attribute">4011bd</span>:	<span class="hljs-number">48</span> <span class="hljs-number">8</span>b <span class="hljs-number">10</span>             	mov    (%rax),%rdx
  <span class="hljs-attribute">4011c0</span>:	<span class="hljs-number">48</span> <span class="hljs-number">89</span> <span class="hljs-number">51</span> <span class="hljs-number">08</span>          	mov    %rdx,<span class="hljs-number">0</span>x<span class="hljs-number">8</span>(%rcx)
  <span class="hljs-attribute">4011c4</span>:	<span class="hljs-number">48</span> <span class="hljs-number">83</span> c<span class="hljs-number">0</span> <span class="hljs-number">08</span>          	add    $<span class="hljs-number">0</span>x<span class="hljs-number">8</span>,%rax              # 
  <span class="hljs-attribute">4011c8</span>:	<span class="hljs-number">48</span> <span class="hljs-number">39</span> f<span class="hljs-number">0</span>             	cmp    %rsi,%rax              # 抵达链表末尾
  <span class="hljs-attribute">4011cb</span>:	<span class="hljs-number">74</span> <span class="hljs-number">05</span>                	je     <span class="hljs-number">4011</span>d<span class="hljs-number">2</span> &lt;phase_<span class="hljs-number">6</span>+<span class="hljs-number">0</span>xde&gt;  # 到末尾就跳走
  <span class="hljs-attribute">4011cd</span>:	<span class="hljs-number">48</span> <span class="hljs-number">89</span> d<span class="hljs-number">1</span>             	mov    %rdx,%rcx              # 
  <span class="hljs-attribute">4011d0</span>:	eb eb                	jmp    <span class="hljs-number">4011</span>bd &lt;phase_<span class="hljs-number">6</span>+<span class="hljs-number">0</span>xc<span class="hljs-number">9</span>&gt;
  <span class="hljs-attribute">4011d2</span>:	<span class="hljs-number">48</span> c<span class="hljs-number">7</span> <span class="hljs-number">42</span> <span class="hljs-number">08</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> 	movq   $<span class="hljs-number">0</span>x<span class="hljs-number">0</span>,<span class="hljs-number">0</span>x<span class="hljs-number">8</span>(%rdx)         
  <span class="hljs-attribute">4011d9</span>:	<span class="hljs-number">00</span>
  <span class="hljs-attribute">4011da</span>:	bd <span class="hljs-number">05</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	mov    $<span class="hljs-number">0</span>x<span class="hljs-number">5</span>,%ebp              # ---循环初始化，i=<span class="hljs-number">5</span>---
  <span class="hljs-attribute">4011df</span>:	<span class="hljs-number">48</span> <span class="hljs-number">8</span>b <span class="hljs-number">43</span> <span class="hljs-number">08</span>          	mov    <span class="hljs-number">0</span>x<span class="hljs-number">8</span>(%rbx),%rax         # x = nn-&gt;next
  <span class="hljs-attribute">4011e3</span>:	<span class="hljs-number">8</span>b <span class="hljs-number">00</span>                	mov    (%rax),%eax            # x = x-&gt;val
  <span class="hljs-attribute">4011e5</span>:	<span class="hljs-number">39</span> <span class="hljs-number">03</span>                	cmp    %eax,(%rbx)
  <span class="hljs-attribute">4011e7</span>:	<span class="hljs-number">7</span>d <span class="hljs-number">05</span>                	jge    <span class="hljs-number">4011</span>ee &lt;phase_<span class="hljs-number">6</span>+<span class="hljs-number">0</span>xfa&gt;  # x &gt;= nn-&gt;val 才正常
  <span class="hljs-attribute">4011e9</span>:	e<span class="hljs-number">8</span> <span class="hljs-number">4</span>c <span class="hljs-number">02</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	callq  <span class="hljs-number">40143</span>a &lt;explode_bomb&gt;  # (即nn-&gt;val &gt;= nn-&gt;next-&gt;val)
  <span class="hljs-attribute">4011ee</span>:	<span class="hljs-number">48</span> <span class="hljs-number">8</span>b <span class="hljs-number">5</span>b <span class="hljs-number">08</span>          	mov    <span class="hljs-number">0</span>x<span class="hljs-number">8</span>(%rbx),%rbx         # nn = nn-&gt;next
  <span class="hljs-attribute">4011f2</span>:	<span class="hljs-number">83</span> ed <span class="hljs-number">01</span>             	sub    $<span class="hljs-number">0</span>x<span class="hljs-number">1</span>,%ebp              # i--
  <span class="hljs-attribute">4011f5</span>:	<span class="hljs-number">75</span> e<span class="hljs-number">8</span>                	jne    <span class="hljs-number">4011</span>df &lt;phase_<span class="hljs-number">6</span>+<span class="hljs-number">0</span>xeb&gt;
  <span class="hljs-attribute">4011f7</span>:	<span class="hljs-number">48</span> <span class="hljs-number">83</span> c<span class="hljs-number">4</span> <span class="hljs-number">50</span>          	add    $<span class="hljs-number">0</span>x<span class="hljs-number">50</span>,%rsp
  <span class="hljs-attribute">4011fb</span>:	<span class="hljs-number">5</span>b                   	pop    %rbx
  <span class="hljs-attribute">4011fc</span>:	<span class="hljs-number">5</span>d                   	pop    %rbp
  <span class="hljs-attribute">4011fd</span>:	<span class="hljs-number">41</span> <span class="hljs-number">5</span>c                	pop    %r<span class="hljs-number">12</span>
  <span class="hljs-attribute">4011ff</span>:	<span class="hljs-number">41</span> <span class="hljs-number">5</span>d                	pop    %r<span class="hljs-number">13</span>
  <span class="hljs-attribute">401201</span>:	<span class="hljs-number">41</span> <span class="hljs-number">5</span>e                	pop    %r<span class="hljs-number">14</span>
  <span class="hljs-attribute">401203</span>:	c<span class="hljs-number">3</span>                   	retq</code></pre>
<p>查看汇编中出现的地址</p>
<pre><code class="hljs angelscript">(gdb) x/<span class="hljs-number">24</span>xw <span class="hljs-number">0x6032d0</span>
<span class="hljs-number">0x6032d0</span> &lt;node1&gt;:       <span class="hljs-number">0x0000014c</span>      <span class="hljs-number">0x00000001</span>      <span class="hljs-number">0x006032e0</span>      <span class="hljs-number">0x00000000</span>
<span class="hljs-number">0x6032e0</span> &lt;node2&gt;:       <span class="hljs-number">0x000000a8</span>      <span class="hljs-number">0x00000002</span>      <span class="hljs-number">0x006032f0</span>      <span class="hljs-number">0x00000000</span>
<span class="hljs-number">0x6032f0</span> &lt;node3&gt;:       <span class="hljs-number">0x0000039c</span>      <span class="hljs-number">0x00000003</span>      <span class="hljs-number">0x00603300</span>      <span class="hljs-number">0x00000000</span>
<span class="hljs-number">0x603300</span> &lt;node4&gt;:       <span class="hljs-number">0x000002b3</span>      <span class="hljs-number">0x00000004</span>      <span class="hljs-number">0x00603310</span>      <span class="hljs-number">0x00000000</span>
<span class="hljs-number">0x603310</span> &lt;node5&gt;:       <span class="hljs-number">0x000001dd</span>      <span class="hljs-number">0x00000005</span>      <span class="hljs-number">0x00603320</span>      <span class="hljs-number">0x00000000</span>
<span class="hljs-number">0x603320</span> &lt;node6&gt;:       <span class="hljs-number">0x000001bb</span>      <span class="hljs-number">0x00000006</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span></code></pre>
<p>看起来是个链表，<code>node1</code>按顺序连到<code>node6</code></p>
<p>看看数据在栈里面怎么放</p>
<pre><code class="hljs angelscript">(gdb) x/<span class="hljs-number">24</span>xw $sp+<span class="hljs-number">0x20</span>
<span class="hljs-number">0x7ffffffede30</span>: <span class="hljs-number">0x006032d0</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x006032e0</span>      <span class="hljs-number">0x00000000</span>
<span class="hljs-number">0x7ffffffede40</span>: <span class="hljs-number">0x006032f0</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00603300</span>      <span class="hljs-number">0x00000000</span>
<span class="hljs-number">0x7ffffffede50</span>: <span class="hljs-number">0x00603310</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00603320</span>      <span class="hljs-number">0x00000000</span></code></pre>
<p>也就是把每个链表的地址塞进来。</p>
<p>由最后一段知，node 应该按第一个字降序排序，即</p>
<p><code>node3 -&gt; node4 -&gt; node5 -&gt; node6 -&gt; node1 -&gt; node2</code></p>
<p>即数字 <code>3 4 5 6 1 2</code>，利用<code>7-x</code>转换得</p>
<pre><code class="hljs basic"><span class="hljs-symbol">4 </span><span class="hljs-number">3</span> <span class="hljs-number">2</span> <span class="hljs-number">1</span> <span class="hljs-number">6</span> <span class="hljs-number">5</span></code></pre>
<h2 id="secret_phase"><a class="markdownIt-Anchor" href="#secret_phase"></a> secret_phase</h2>
<p>终于到了隐藏关</p>
<pre><code class="hljs angelscript"><span class="hljs-number">0000000000401242</span> &lt;secret_phase&gt;:
  <span class="hljs-number">401242</span>:	<span class="hljs-number">53</span>                   	push   %rbx
  <span class="hljs-number">401243</span>:	e8 <span class="hljs-number">56</span> <span class="hljs-number">02</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	callq  <span class="hljs-number">40149</span>e &lt;read_line&gt;
  <span class="hljs-number">401248</span>:	ba <span class="hljs-number">0</span>a <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	mov    $<span class="hljs-number">0xa</span>,%edx              # <span class="hljs-number">10</span>
  <span class="hljs-number">40124</span>d:	be <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	mov    $<span class="hljs-number">0x0</span>,%esi              # 传参 <span class="hljs-number">0</span>
  <span class="hljs-number">401252</span>:	<span class="hljs-number">48</span> <span class="hljs-number">89</span> c7             	mov    %rax,%rdi              # 传参
  <span class="hljs-number">401255</span>:	e8 <span class="hljs-number">76</span> f9 ff ff       	callq  <span class="hljs-number">400</span>bd0 &lt;<span class="hljs-symbol">strtol@</span>plt&gt;    # strtol(%rdi,<span class="hljs-literal">null</span>,<span class="hljs-number">10</span>)
  <span class="hljs-number">40125</span>a:	<span class="hljs-number">48</span> <span class="hljs-number">89</span> c3             	mov    %rax,%rbx              # 返回的数字
  <span class="hljs-number">40125</span>d:	<span class="hljs-number">8</span>d <span class="hljs-number">40</span> ff             	lea    <span class="hljs-number">-0x1</span>(%rax),%eax
  <span class="hljs-number">401260</span>:	<span class="hljs-number">3</span>d e8 <span class="hljs-number">03</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	cmp    $<span class="hljs-number">0x3e8</span>,%eax
  <span class="hljs-number">401265</span>:	<span class="hljs-number">76</span> <span class="hljs-number">05</span>                	jbe    <span class="hljs-number">40126</span>c &lt;secret_phase+<span class="hljs-number">0x2a</span>&gt;
  <span class="hljs-number">401267</span>:	e8 ce <span class="hljs-number">01</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	callq  <span class="hljs-number">40143</span>a &lt;explode_bomb&gt;
  <span class="hljs-number">40126</span>c:	<span class="hljs-number">89</span> de                	mov    %ebx,%esi
  <span class="hljs-number">40126</span>e:	bf f0 <span class="hljs-number">30</span> <span class="hljs-number">60</span> <span class="hljs-number">00</span>       	mov    $<span class="hljs-number">0x6030f0</span>,%edi
  <span class="hljs-number">401273</span>:	e8 <span class="hljs-number">8</span>c ff ff ff       	callq  <span class="hljs-number">401204</span> &lt;fun7&gt;          # fun7(%edi,%esi)
  <span class="hljs-number">401278</span>:	<span class="hljs-number">83</span> f8 <span class="hljs-number">02</span>             	cmp    $<span class="hljs-number">0x2</span>,%eax              # fun7(%edi,%esi) == <span class="hljs-number">0</span> ?
  <span class="hljs-number">40127</span>b:	<span class="hljs-number">74</span> <span class="hljs-number">05</span>                	je     <span class="hljs-number">401282</span> &lt;secret_phase+<span class="hljs-number">0x40</span>&gt; # != boom~~~
  <span class="hljs-number">40127</span>d:	e8 b8 <span class="hljs-number">01</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	callq  <span class="hljs-number">40143</span>a &lt;explode_bomb&gt;
  <span class="hljs-number">401282</span>:	bf <span class="hljs-number">38</span> <span class="hljs-number">24</span> <span class="hljs-number">40</span> <span class="hljs-number">00</span>       	mov    $<span class="hljs-number">0x402438</span>,%edi
  <span class="hljs-number">401287</span>:	e8 <span class="hljs-number">84</span> f8 ff ff       	callq  <span class="hljs-number">400</span>b10 &lt;<span class="hljs-symbol">puts@</span>plt&gt;
  <span class="hljs-number">40128</span>c:	e8 <span class="hljs-number">33</span> <span class="hljs-number">03</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	callq  <span class="hljs-number">4015</span>c4 &lt;phase_defused&gt;
  <span class="hljs-number">401291</span>:	<span class="hljs-number">5</span>b                   	pop    %rbx
  <span class="hljs-number">401292</span>:	c3                   	retq   
  <span class="hljs-number">401293</span>:	<span class="hljs-number">90</span>                   	nop
  <span class="hljs-number">401294</span>:	<span class="hljs-number">90</span>                   	nop
  <span class="hljs-number">401295</span>:	<span class="hljs-number">90</span>                   	nop
  <span class="hljs-number">401296</span>:	<span class="hljs-number">90</span>                   	nop
  <span class="hljs-number">401297</span>:	<span class="hljs-number">90</span>                   	nop
  <span class="hljs-number">401298</span>:	<span class="hljs-number">90</span>                   	nop
  <span class="hljs-number">401299</span>:	<span class="hljs-number">90</span>                   	nop
  <span class="hljs-number">40129</span>a:	<span class="hljs-number">90</span>                   	nop
  <span class="hljs-number">40129</span>b:	<span class="hljs-number">90</span>                   	nop
  <span class="hljs-number">40129</span>c:	<span class="hljs-number">90</span>                   	nop
  <span class="hljs-number">40129</span>d:	<span class="hljs-number">90</span>                   	nop
  <span class="hljs-number">40129</span>e:	<span class="hljs-number">90</span>                   	nop
  <span class="hljs-number">40129f</span>:	<span class="hljs-number">90</span>                   	nop</code></pre>
<p>查询<code>strtol</code>得到</p>
<p>C 库函数 *<em>long int strtol(const char *str, char *<em>endptr, int base)</em></em> 把参数 <strong>str</strong> 所指向的字符串根据给定的 <strong>base</strong> 转换为一个长整数（类型为 long int 型），base 必须介于 2 和 36（包含）之间，或者是特殊值 0。</p>
<p>下面是 strtol() 函数的声明。</p>
<pre><code class="hljs csharp"><span class="hljs-function"><span class="hljs-keyword">long</span> <span class="hljs-keyword">int</span> <span class="hljs-title">strtol</span>(<span class="hljs-params"><span class="hljs-keyword">const</span> <span class="hljs-keyword">char</span> *str, <span class="hljs-keyword">char</span> **endptr, <span class="hljs-keyword">int</span> <span class="hljs-keyword">base</span></span>)</span></code></pre>
<p>看看<code>fun7</code>里面是啥</p>
<pre><code class="hljs apache"><span class="hljs-attribute">0000000000401204</span> &lt;fun<span class="hljs-number">7</span>&gt;:      # fun<span class="hljs-number">7</span>(int* p, int q)  p:%rdi
  <span class="hljs-attribute">401204</span>:	<span class="hljs-number">48</span> <span class="hljs-number">83</span> ec <span class="hljs-number">08</span>          	sub    $<span class="hljs-number">0</span>x<span class="hljs-number">8</span>,%rsp
  <span class="hljs-attribute">401208</span>:	<span class="hljs-number">48</span> <span class="hljs-number">85</span> ff             	test   %rdi,%rdi          # 参数为<span class="hljs-number">0</span>返回全<span class="hljs-number">1</span>
  <span class="hljs-attribute">40120b</span>:	<span class="hljs-number">74</span> <span class="hljs-number">2</span>b                	je     <span class="hljs-number">401238</span> &lt;fun<span class="hljs-number">7</span>+<span class="hljs-number">0</span>x<span class="hljs-number">34</span>&gt;
  <span class="hljs-attribute">40120d</span>:	<span class="hljs-number">8</span>b <span class="hljs-number">17</span>                	mov    (%rdi),%edx        
  <span class="hljs-attribute">40120f</span>:	<span class="hljs-number">39</span> f<span class="hljs-number">2</span>                	cmp    %esi,%edx          # 
  <span class="hljs-attribute">401211</span>:	<span class="hljs-number">7</span>e <span class="hljs-number">0</span>d                	jle    <span class="hljs-number">401220</span> &lt;fun<span class="hljs-number">7</span>+<span class="hljs-number">0</span>x<span class="hljs-number">1</span>c&gt; # *p &lt;= q
  <span class="hljs-attribute">401213</span>:	<span class="hljs-number">48</span> <span class="hljs-number">8</span>b <span class="hljs-number">7</span>f <span class="hljs-number">08</span>          	mov    <span class="hljs-number">0</span>x<span class="hljs-number">8</span>(%rdi),%rdi     # *p &gt; q, p = *(p+<span class="hljs-number">8</span>)
  <span class="hljs-attribute">401217</span>:	e<span class="hljs-number">8</span> e<span class="hljs-number">8</span> ff ff ff       	callq  <span class="hljs-number">401204</span> &lt;fun<span class="hljs-number">7</span>&gt;      # fun<span class="hljs-number">7</span>(p+<span class="hljs-number">8</span>,q)
  <span class="hljs-attribute">40121c</span>:	<span class="hljs-number">01</span> c<span class="hljs-number">0</span>                	add    %eax,%eax          # return(<span class="hljs-number">2</span>*fun<span class="hljs-number">7</span>(p+<span class="hljs-number">8</span>,q))
  <span class="hljs-attribute">40121e</span>:	eb <span class="hljs-number">1</span>d                	jmp    <span class="hljs-number">40123</span>d &lt;fun<span class="hljs-number">7</span>+<span class="hljs-number">0</span>x<span class="hljs-number">39</span>&gt;
  <span class="hljs-attribute">401220</span>:	b<span class="hljs-number">8</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	mov    $<span class="hljs-number">0</span>x<span class="hljs-number">0</span>,%eax          # return <span class="hljs-number">0</span>
  <span class="hljs-attribute">401225</span>:	<span class="hljs-number">39</span> f<span class="hljs-number">2</span>                	cmp    %esi,%edx
  <span class="hljs-attribute">401227</span>:	<span class="hljs-number">74</span> <span class="hljs-number">14</span>                	je     <span class="hljs-number">40123</span>d &lt;fun<span class="hljs-number">7</span>+<span class="hljs-number">0</span>x<span class="hljs-number">39</span>&gt; # *p == q
  <span class="hljs-attribute">401229</span>:	<span class="hljs-number">48</span> <span class="hljs-number">8</span>b <span class="hljs-number">7</span>f <span class="hljs-number">10</span>          	mov    <span class="hljs-number">0</span>x<span class="hljs-number">10</span>(%rdi),%rdi    # *p &lt; q, p = *(p+<span class="hljs-number">16</span>)
  <span class="hljs-attribute">40122d</span>:	e<span class="hljs-number">8</span> d<span class="hljs-number">2</span> ff ff ff       	callq  <span class="hljs-number">401204</span> &lt;fun<span class="hljs-number">7</span>&gt;      # fun<span class="hljs-number">7</span>(p+<span class="hljs-number">16</span>,q)
  <span class="hljs-attribute">401232</span>:	<span class="hljs-number">8</span>d <span class="hljs-number">44</span> <span class="hljs-number">00</span> <span class="hljs-number">01</span>          	lea    <span class="hljs-number">0</span>x<span class="hljs-number">1</span>(%rax,%rax,<span class="hljs-number">1</span>),%eax  # eax = eax*<span class="hljs-number">2</span>+<span class="hljs-number">1</span>
  <span class="hljs-attribute">401236</span>:	eb <span class="hljs-number">05</span>                	jmp    <span class="hljs-number">40123</span>d &lt;fun<span class="hljs-number">7</span>+<span class="hljs-number">0</span>x<span class="hljs-number">39</span>&gt; # return(<span class="hljs-number">1</span>+<span class="hljs-number">2</span>*fun<span class="hljs-number">7</span>(p+<span class="hljs-number">16</span>,q))
  <span class="hljs-attribute">401238</span>:	b<span class="hljs-number">8</span> ff ff ff ff       	mov    $<span class="hljs-number">0</span>xffffffff,%eax
  <span class="hljs-attribute">40123d</span>:	<span class="hljs-number">48</span> <span class="hljs-number">83</span> c<span class="hljs-number">4</span> <span class="hljs-number">08</span>          	add    $<span class="hljs-number">0</span>x<span class="hljs-number">8</span>,%rsp
  <span class="hljs-attribute">401241</span>:	c<span class="hljs-number">3</span>                   	retq</code></pre>
<p>基本可以改写成c</p>
<pre><code class="hljs c"><span class="hljs-function"><span class="hljs-keyword">int</span> <span class="hljs-title">fun7</span><span class="hljs-params">(<span class="hljs-keyword">int</span> c, Binary_tree_node* root)</span></span>
<span class="hljs-function"></span>&#123;
    <span class="hljs-keyword">if</span> (!root)
        <span class="hljs-keyword">return</span> <span class="hljs-number">-1</span>;
    <span class="hljs-keyword">int</span> v = root-&gt;val;
    <span class="hljs-keyword">if</span> (v == c)
        <span class="hljs-keyword">return</span> <span class="hljs-number">0</span>;
    <span class="hljs-keyword">else</span> <span class="hljs-keyword">if</span> (v &lt; c)
        <span class="hljs-keyword">return</span> <span class="hljs-number">1</span> + <span class="hljs-number">2</span> * fun7(c, root-&gt;right);
    <span class="hljs-keyword">else</span>
        <span class="hljs-keyword">return</span> <span class="hljs-number">2</span> * func7(c, root-&gt;left);
&#125;</code></pre>
<p>对比一下传进去的地址</p>
<pre><code class="hljs angelscript">(gdb) x/<span class="hljs-number">120</span>xw <span class="hljs-number">0x6030f0</span>
<span class="hljs-number">0x6030f0</span> &lt;n1&gt;:  		<span class="hljs-number">0x00000024</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00603110</span>      <span class="hljs-number">0x00000000</span>
<span class="hljs-number">0x603100</span> &lt;n1+<span class="hljs-number">16</span>&gt;:       <span class="hljs-number">0x00603130</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>
<span class="hljs-number">0x603110</span> &lt;n21&gt;: 		<span class="hljs-number">0x00000008</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00603190</span>      <span class="hljs-number">0x00000000</span>
<span class="hljs-number">0x603120</span> &lt;n21+<span class="hljs-number">16</span>&gt;:      <span class="hljs-number">0x00603150</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>
<span class="hljs-number">0x603130</span> &lt;n22&gt;: 		<span class="hljs-number">0x00000032</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00603170</span>      <span class="hljs-number">0x00000000</span>
<span class="hljs-number">0x603140</span> &lt;n22+<span class="hljs-number">16</span>&gt;:      <span class="hljs-number">0x006031b0</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>
<span class="hljs-number">0x603150</span> &lt;n32&gt;: 		<span class="hljs-number">0x00000016</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00603270</span>      <span class="hljs-number">0x00000000</span>
<span class="hljs-number">0x603160</span> &lt;n32+<span class="hljs-number">16</span>&gt;:      <span class="hljs-number">0x00603230</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>
<span class="hljs-number">0x603170</span> &lt;n33&gt;: 		<span class="hljs-number">0x0000002d</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x006031d0</span>      <span class="hljs-number">0x00000000</span>
<span class="hljs-number">0x603180</span> &lt;n33+<span class="hljs-number">16</span>&gt;:      <span class="hljs-number">0x00603290</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>
<span class="hljs-number">0x603190</span> &lt;n31&gt;: 		<span class="hljs-number">0x00000006</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x006031f0</span>      <span class="hljs-number">0x00000000</span>
<span class="hljs-number">0x6031a0</span> &lt;n31+<span class="hljs-number">16</span>&gt;:      <span class="hljs-number">0x00603250</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>
<span class="hljs-number">0x6031b0</span> &lt;n34&gt;: 		<span class="hljs-number">0x0000006b</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00603210</span>      <span class="hljs-number">0x00000000</span>
<span class="hljs-number">0x6031c0</span> &lt;n34+<span class="hljs-number">16</span>&gt;:      <span class="hljs-number">0x006032b0</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>
<span class="hljs-number">0x6031d0</span> &lt;n45&gt;: 		<span class="hljs-number">0x00000028</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>
<span class="hljs-number">0x6031e0</span> &lt;n45+<span class="hljs-number">16</span>&gt;:      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>
<span class="hljs-number">0x6031f0</span> &lt;n41&gt;: 		<span class="hljs-number">0x00000001</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>
<span class="hljs-number">0x603200</span> &lt;n41+<span class="hljs-number">16</span>&gt;:      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>
<span class="hljs-number">0x603210</span> &lt;n47&gt;: 		<span class="hljs-number">0x00000063</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>
<span class="hljs-number">0x603220</span> &lt;n47+<span class="hljs-number">16</span>&gt;:      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>
<span class="hljs-number">0x603230</span> &lt;n44&gt;: 		<span class="hljs-number">0x00000023</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>
<span class="hljs-number">0x603240</span> &lt;n44+<span class="hljs-number">16</span>&gt;:      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>
<span class="hljs-number">0x603250</span> &lt;n42&gt;: 		<span class="hljs-number">0x00000007</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>
<span class="hljs-number">0x603260</span> &lt;n42+<span class="hljs-number">16</span>&gt;:      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>
<span class="hljs-number">0x603270</span> &lt;n43&gt;: 		<span class="hljs-number">0x00000014</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>
<span class="hljs-number">0x603280</span> &lt;n43+<span class="hljs-number">16</span>&gt;:      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>
<span class="hljs-number">0x603290</span> &lt;n46&gt;: 		<span class="hljs-number">0x0000002f</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>
<span class="hljs-number">0x6032a0</span> &lt;n46+<span class="hljs-number">16</span>&gt;:      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>
<span class="hljs-number">0x6032b0</span> &lt;n48&gt;: 		<span class="hljs-number">0x000003e9</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>
<span class="hljs-number">0x6032c0</span> &lt;n48+<span class="hljs-number">16</span>&gt;:      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span></code></pre>
<p>目测是二叉树，其结构为</p>
<pre><code class="hljs c"><span class="hljs-class"><span class="hljs-keyword">struct</span> <span class="hljs-title">Binary_tree_node</span>&#123;</span>
    <span class="hljs-keyword">long</span> val;
    Binary_tree* left;
    Binary_tree* right;
&#125;</code></pre>
<p>故有</p>
<pre><code class="hljs mermaid">graph TD;
    n1[0x24&#x3D;36]--&gt;n21[0x8&#x3D;8];
    n1--&gt;n22[0x32&#x3D;50]
    n21--&gt;n31[0x6&#x3D;6]
    n21--&gt;n32[0x16&#x3D;22]
    n22--&gt;n33[0x2d&#x3D;45]
    n22--&gt;n34[0x6b&#x3D;107]
    n31--&gt;n41[0x1&#x3D;1]
    n31--&gt;n42[0x7&#x3D;7]
    n32--&gt;n43[0x14&#x3D;20]
    n32--&gt;n44[0x23&#x3D;35]
    n33--&gt;n45[0x28&#x3D;40]
    n33--&gt;n46[0x2f&#x3D;47]
    n34--&gt;n47[0x63&#x3D;99]
    n34--&gt;n48[0x3e9&#x3D;1011]</code></pre>
<p>因此有两个可能的答案：</p>
<pre><code class="hljs angelscript"><span class="hljs-number">20</span>
<span class="hljs-number">22</span></code></pre>
<p>然后发现不知道怎么进入隐藏关。。。</p>
<p>搜索一下在&lt;phase_defused&gt;中找到了它的调用。</p>
<pre><code class="hljs apache"><span class="hljs-attribute">00000000004015c4</span> &lt;phase_defused&gt;:
  <span class="hljs-attribute">4015c4</span>:	<span class="hljs-number">48</span> <span class="hljs-number">83</span> ec <span class="hljs-number">78</span>          	sub    $<span class="hljs-number">0</span>x<span class="hljs-number">78</span>,%rsp
  <span class="hljs-attribute">4015c8</span>:	<span class="hljs-number">64</span> <span class="hljs-number">48</span> <span class="hljs-number">8</span>b <span class="hljs-number">04</span> <span class="hljs-number">25</span> <span class="hljs-number">28</span> <span class="hljs-number">00</span> 	mov    %fs:<span class="hljs-number">0</span>x<span class="hljs-number">28</span>,%rax              # 金丝雀
  <span class="hljs-attribute">4015cf</span>:	<span class="hljs-number">00</span> <span class="hljs-number">00</span> 
  <span class="hljs-attribute">4015d1</span>:	<span class="hljs-number">48</span> <span class="hljs-number">89</span> <span class="hljs-number">44</span> <span class="hljs-number">24</span> <span class="hljs-number">68</span>       	mov    %rax,<span class="hljs-number">0</span>x<span class="hljs-number">68</span>(%rsp)            # 金丝雀
  <span class="hljs-attribute">4015d6</span>:	<span class="hljs-number">31</span> c<span class="hljs-number">0</span>                	xor    %eax,%eax
  <span class="hljs-attribute">4015d8</span>:	<span class="hljs-number">83</span> <span class="hljs-number">3</span>d <span class="hljs-number">81</span> <span class="hljs-number">21</span> <span class="hljs-number">20</span> <span class="hljs-number">00</span> <span class="hljs-number">06</span> 	cmpl   $<span class="hljs-number">0</span>x<span class="hljs-number">6</span>,<span class="hljs-number">0</span>x<span class="hljs-number">202181</span>(%rip)        # <span class="hljs-number">603760</span> &lt;num_input_strings&gt;
  <span class="hljs-attribute">4015df</span>:	<span class="hljs-number">75</span> <span class="hljs-number">5</span>e                	jne    <span class="hljs-number">40163</span>f &lt;phase_defused+<span class="hljs-number">0</span>x<span class="hljs-number">7</span>b&gt;
  <span class="hljs-attribute">4015e1</span>:	<span class="hljs-number">4</span>c <span class="hljs-number">8</span>d <span class="hljs-number">44</span> <span class="hljs-number">24</span> <span class="hljs-number">10</span>       	lea    <span class="hljs-number">0</span>x<span class="hljs-number">10</span>(%rsp),%r<span class="hljs-number">8</span>
  <span class="hljs-attribute">4015e6</span>:	<span class="hljs-number">48</span> <span class="hljs-number">8</span>d <span class="hljs-number">4</span>c <span class="hljs-number">24</span> <span class="hljs-number">0</span>c       	lea    <span class="hljs-number">0</span>xc(%rsp),%rcx
  <span class="hljs-attribute">4015eb</span>:	<span class="hljs-number">48</span> <span class="hljs-number">8</span>d <span class="hljs-number">54</span> <span class="hljs-number">24</span> <span class="hljs-number">08</span>       	lea    <span class="hljs-number">0</span>x<span class="hljs-number">8</span>(%rsp),%rdx
  <span class="hljs-attribute">4015f0</span>:	be <span class="hljs-number">19</span> <span class="hljs-number">26</span> <span class="hljs-number">40</span> <span class="hljs-number">00</span>       	mov    $<span class="hljs-number">0</span>x<span class="hljs-number">402619</span>,%esi             # <span class="hljs-string">&quot;%d %d %s&quot;</span>
  <span class="hljs-attribute">4015f5</span>:	bf <span class="hljs-number">70</span> <span class="hljs-number">38</span> <span class="hljs-number">60</span> <span class="hljs-number">00</span>       	mov    $<span class="hljs-number">0</span>x<span class="hljs-number">603870</span>,%edi             # buffer
  <span class="hljs-attribute">4015fa</span>:	e<span class="hljs-number">8</span> f<span class="hljs-number">1</span> f<span class="hljs-number">5</span> ff ff       	callq  <span class="hljs-number">400</span>bf<span class="hljs-number">0</span> &lt;__isoc<span class="hljs-number">99</span>_sscanf@plt&gt;
  <span class="hljs-attribute">4015ff</span>:	<span class="hljs-number">83</span> f<span class="hljs-number">8</span> <span class="hljs-number">03</span>             	cmp    $<span class="hljs-number">0</span>x<span class="hljs-number">3</span>,%eax                  # 确认<span class="hljs-number">3</span>个量都匹配成功
  <span class="hljs-attribute">401602</span>:	<span class="hljs-number">75</span> <span class="hljs-number">31</span>                	jne    <span class="hljs-number">401635</span> &lt;phase_defused+<span class="hljs-number">0</span>x<span class="hljs-number">71</span>&gt;
  <span class="hljs-attribute">401604</span>:	be <span class="hljs-number">22</span> <span class="hljs-number">26</span> <span class="hljs-number">40</span> <span class="hljs-number">00</span>       	mov    $<span class="hljs-number">0</span>x<span class="hljs-number">402622</span>,%esi             # <span class="hljs-string">&quot;DrEvil&quot;</span>
  <span class="hljs-attribute">401609</span>:	<span class="hljs-number">48</span> <span class="hljs-number">8</span>d <span class="hljs-number">7</span>c <span class="hljs-number">24</span> <span class="hljs-number">10</span>       	lea    <span class="hljs-number">0</span>x<span class="hljs-number">10</span>(%rsp),%rdi            # sscanf 的第三个，即 %s
  <span class="hljs-attribute">40160e</span>:	e<span class="hljs-number">8</span> <span class="hljs-number">25</span> fd ff ff       	callq  <span class="hljs-number">401338</span> &lt;strings_not_equal&gt;
  <span class="hljs-attribute">401613</span>:	<span class="hljs-number">85</span> c<span class="hljs-number">0</span>                	test   %eax,%eax                  # 
  <span class="hljs-attribute">401615</span>:	<span class="hljs-number">75</span> <span class="hljs-number">1</span>e                	jne    <span class="hljs-number">401635</span> &lt;phase_defused+<span class="hljs-number">0</span>x<span class="hljs-number">71</span>&gt;
  <span class="hljs-attribute">401617</span>:	bf f<span class="hljs-number">8</span> <span class="hljs-number">24</span> <span class="hljs-number">40</span> <span class="hljs-number">00</span>       	mov    $<span class="hljs-number">0</span>x<span class="hljs-number">4024</span>f<span class="hljs-number">8</span>,%edi
  <span class="hljs-attribute">40161c</span>:	e<span class="hljs-number">8</span> ef f<span class="hljs-number">4</span> ff ff       	callq  <span class="hljs-number">400</span>b<span class="hljs-number">10</span> &lt;puts@plt&gt;          # 祝贺词
  <span class="hljs-attribute">401621</span>:	bf <span class="hljs-number">20</span> <span class="hljs-number">25</span> <span class="hljs-number">40</span> <span class="hljs-number">00</span>       	mov    $<span class="hljs-number">0</span>x<span class="hljs-number">402520</span>,%edi
  <span class="hljs-attribute">401626</span>:	e<span class="hljs-number">8</span> e<span class="hljs-number">5</span> f<span class="hljs-number">4</span> ff ff       	callq  <span class="hljs-number">400</span>b<span class="hljs-number">10</span> &lt;puts@plt&gt;          # 提示
  <span class="hljs-attribute">40162b</span>:	b<span class="hljs-number">8</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>       	mov    $<span class="hljs-number">0</span>x<span class="hljs-number">0</span>,%eax
  <span class="hljs-attribute">401630</span>:	e<span class="hljs-number">8</span> <span class="hljs-number">0</span>d fc ff ff       	callq  <span class="hljs-number">401242</span> &lt;secret_phase&gt;      # 正式进入隐藏关卡
  <span class="hljs-attribute">401635</span>:	bf <span class="hljs-number">58</span> <span class="hljs-number">25</span> <span class="hljs-number">40</span> <span class="hljs-number">00</span>       	mov    $<span class="hljs-number">0</span>x<span class="hljs-number">402558</span>,%edi
  <span class="hljs-attribute">40163a</span>:	e<span class="hljs-number">8</span> d<span class="hljs-number">1</span> f<span class="hljs-number">4</span> ff ff       	callq  <span class="hljs-number">400</span>b<span class="hljs-number">10</span> &lt;puts@plt&gt;          # 解答成功的最终祝贺
  <span class="hljs-attribute">40163f</span>:	<span class="hljs-number">48</span> <span class="hljs-number">8</span>b <span class="hljs-number">44</span> <span class="hljs-number">24</span> <span class="hljs-number">68</span>       	mov    <span class="hljs-number">0</span>x<span class="hljs-number">68</span>(%rsp),%rax
  <span class="hljs-attribute">401644</span>:	<span class="hljs-number">64</span> <span class="hljs-number">48</span> <span class="hljs-number">33</span> <span class="hljs-number">04</span> <span class="hljs-number">25</span> <span class="hljs-number">28</span> <span class="hljs-number">00</span> 	xor    %fs:<span class="hljs-number">0</span>x<span class="hljs-number">28</span>,%rax              # 验证金丝雀
  <span class="hljs-attribute">40164b</span>:	<span class="hljs-number">00</span> <span class="hljs-number">00</span> 
  <span class="hljs-attribute">40164d</span>:	<span class="hljs-number">74</span> <span class="hljs-number">05</span>                	je     <span class="hljs-number">401654</span> &lt;phase_defused+<span class="hljs-number">0</span>x<span class="hljs-number">90</span>&gt;
  <span class="hljs-attribute">40164f</span>:	e<span class="hljs-number">8</span> dc f<span class="hljs-number">4</span> ff ff       	callq  <span class="hljs-number">400</span>b<span class="hljs-number">30</span> &lt;__stack_chk_fail@plt&gt;  # 验证失败
  <span class="hljs-attribute">401654</span>:	<span class="hljs-number">48</span> <span class="hljs-number">83</span> c<span class="hljs-number">4</span> <span class="hljs-number">78</span>          	add    $<span class="hljs-number">0</span>x<span class="hljs-number">78</span>,%rsp
  <span class="hljs-attribute">401658</span>:	c<span class="hljs-number">3</span>                   	retq   
  <span class="hljs-attribute">401659</span>:	<span class="hljs-number">90</span>                   	nop
  <span class="hljs-attribute">40165a</span>:	<span class="hljs-number">90</span>                   	nop
  <span class="hljs-attribute">40165b</span>:	<span class="hljs-number">90</span>                   	nop
  <span class="hljs-attribute">40165c</span>:	<span class="hljs-number">90</span>                   	nop
  <span class="hljs-attribute">40165d</span>:	<span class="hljs-number">90</span>                   	nop
  <span class="hljs-attribute">40165e</span>:	<span class="hljs-number">90</span>                   	nop
  <span class="hljs-attribute">40165f</span>:	<span class="hljs-number">90</span>                   	nop</code></pre>
<p>再看看哪里会触发</p>
<pre><code class="hljs yaml"><span class="hljs-string">Welcome</span> <span class="hljs-string">to</span> <span class="hljs-string">my</span> <span class="hljs-string">fiendish</span> <span class="hljs-string">little</span> <span class="hljs-string">bomb.</span> <span class="hljs-string">You</span> <span class="hljs-string">have</span> <span class="hljs-number">6</span> <span class="hljs-string">phases</span> <span class="hljs-string">with</span>
<span class="hljs-string">which</span> <span class="hljs-string">to</span> <span class="hljs-string">blow</span> <span class="hljs-string">yourself</span> <span class="hljs-string">up.</span> <span class="hljs-string">Have</span> <span class="hljs-string">a</span> <span class="hljs-string">nice</span> <span class="hljs-string">day!</span>
<span class="hljs-string">Border</span> <span class="hljs-string">relations</span> <span class="hljs-string">with</span> <span class="hljs-string">Canada</span> <span class="hljs-string">have</span> <span class="hljs-string">never</span> <span class="hljs-string">been</span> <span class="hljs-string">better.</span>
<span class="hljs-string">Phase</span> <span class="hljs-number">1</span> <span class="hljs-string">defused.</span> <span class="hljs-string">How</span> <span class="hljs-string">about</span> <span class="hljs-string">the</span> <span class="hljs-string">next</span> <span class="hljs-string">one?</span>
<span class="hljs-number">1</span> <span class="hljs-number">2</span> <span class="hljs-number">4</span> <span class="hljs-number">8</span> <span class="hljs-number">16</span> <span class="hljs-number">32</span>
<span class="hljs-string">That&#x27;s</span> <span class="hljs-string">number</span> <span class="hljs-number">2</span><span class="hljs-string">.</span>  <span class="hljs-string">Keep</span> <span class="hljs-string">going!</span>
<span class="hljs-number">0</span> <span class="hljs-number">207</span>
<span class="hljs-string">Halfway</span> <span class="hljs-string">there!</span>
<span class="hljs-number">7</span> <span class="hljs-number">0</span>
<span class="hljs-string">So</span> <span class="hljs-string">you</span> <span class="hljs-string">got</span> <span class="hljs-string">that</span> <span class="hljs-string">one.</span>  <span class="hljs-string">Try</span> <span class="hljs-string">this</span> <span class="hljs-string">one.</span>
<span class="hljs-string">ionefg</span>
<span class="hljs-string">Good</span> <span class="hljs-string">work!</span>  <span class="hljs-string">On</span> <span class="hljs-string">to</span> <span class="hljs-string">the</span> <span class="hljs-string">next...</span>
<span class="hljs-number">4</span> <span class="hljs-number">3</span> <span class="hljs-number">2</span> <span class="hljs-number">1</span> <span class="hljs-number">6</span> <span class="hljs-number">5</span>

<span class="hljs-string">Breakpoint</span> <span class="hljs-number">2</span><span class="hljs-string">,</span> <span class="hljs-number">0x00000000004015f0</span> <span class="hljs-string">in</span> <span class="hljs-string">phase_defused</span> <span class="hljs-string">()</span>
<span class="hljs-string">(gdb)</span> <span class="hljs-string">p</span> <span class="hljs-string">*0x603870</span>
<span class="hljs-string">$1</span> <span class="hljs-string">=</span> <span class="hljs-number">3153975</span>
<span class="hljs-string">(gdb)</span> <span class="hljs-string">x/s</span> <span class="hljs-number">0x603870</span>
<span class="hljs-number">0x603870</span> <span class="hljs-string">&lt;input_strings+240&gt;:</span>   <span class="hljs-string">&quot;7 0&quot;</span></code></pre>
<p>所有都炸弹都结束后会触发，而且即将读取的是第四题的答案，因此把第四题的答案改成 “%d %d DrEvil&quot; 即可</p>
<pre><code class="hljs angelscript">(gdb) x/s <span class="hljs-number">0x402619</span>
<span class="hljs-number">0x402619</span>:       <span class="hljs-string">&quot;%d %d %s&quot;</span>
(gdb) x/s <span class="hljs-number">0x603870</span>
<span class="hljs-number">0x603870</span> &lt;input_strings+<span class="hljs-number">240</span>&gt;:   <span class="hljs-string">&quot;&quot;</span>
(gdb) x/<span class="hljs-number">4</span>xw <span class="hljs-number">0x603870</span>
<span class="hljs-number">0x603870</span> &lt;input_strings+<span class="hljs-number">240</span>&gt;:   <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x00000000</span>
(gdb) x/s <span class="hljs-number">0x402622</span>
<span class="hljs-number">0x402622</span>:       <span class="hljs-string">&quot;DrEvil&quot;</span>
(gdb) x/s <span class="hljs-number">0x4024f8</span>
<span class="hljs-number">0x4024f8</span>:       <span class="hljs-string">&quot;Curses, you&#x27;ve found the secret phase!&quot;</span>
(gdb) x/s <span class="hljs-number">0x402520</span>
<span class="hljs-number">0x402520</span>:       <span class="hljs-string">&quot;But finding it and solving it are quite different...&quot;</span></code></pre>
<p>炸弹就彻底拆完了。</p>

            </div>
            <hr>
            <div>
              <div class="post-metas mb-3">
                
                  <div class="post-meta mr-3">
                    <i class="iconfont icon-category"></i>
                    
                      <a class="hover-with-bg" href="/categories/%E6%9D%82/">杂</a>
                    
                  </div>
                
                
                  <div class="post-meta">
                    <i class="iconfont icon-tags"></i>
                    
                      <a class="hover-with-bg" href="/tags/c/">c</a>
                    
                      <a class="hover-with-bg" href="/tags/asm/">asm</a>
                    
                      <a class="hover-with-bg" href="/tags/csapp/">csapp</a>
                    
                      <a class="hover-with-bg" href="/tags/gdb/">gdb</a>
                    
                  </div>
                
              </div>
              
              
                <div class="post-prevnext row">
                  <article class="post-prev col-6">
                    
                    
                      <a href="/2020/11/Automatic-Parallelization-Note-01/">
                        <i class="iconfont icon-arrowleft"></i>
                        <span class="hidden-mobile">Automatic Parallelization Note 01</span>
                        <span class="visible-mobile">上一篇</span>
                      </a>
                    
                  </article>
                  <article class="post-next col-6">
                    
                    
                      <a href="/2020/10/gdb-stack/">
                        <span class="hidden-mobile">gdb 调试——栈</span>
                        <span class="visible-mobile">下一篇</span>
                        <i class="iconfont icon-arrowright"></i>
                      </a>
                    
                  </article>
                </div>
              
            </div>

            
              <!-- Comments -->
              <article class="comments" id="comments">
                
                
  <div id="vcomments"></div>
  <script type="text/javascript">
    function loadValine() {
      addScript('https://cdn.staticfile.org/valine/1.4.14/Valine.min.js', function () {
        new Valine({
          el: "#vcomments",
          app_id: "iAgkjaR2s2ws1XXtS5sVxE7H-MdYXbMMI",
          app_key: "vKka6XRlblVTkbKz8jLXx6EQ",
          placeholder: "你是来自评论区的小惊喜吗 ...",
          path: window.location.pathname,
          avatar: "retro",
          meta: ["nick","mail"],
          pageSize: "10",
          lang: "zh-CN",
          highlight: false,
          recordIP: true,
          serverURLs: "",
        });
      });
    }
    waitElementVisible('vcomments', loadValine);
  </script>
  <noscript>Please enable JavaScript to view the <a target="_blank" href="https://valine.js.org" rel="nofollow noopener noopener">comments
      powered by Valine.</a></noscript>


<!-- 
  <div id="vcomments"></div>
  <script type="text/javascript">
    function loadValine() {
      addScript('https://cdn.staticfile.org/valine/1.4.14/Valine.min.js', function () {
        new Valine({
          el: "#vcomments",
          enableQQ: true,
          boolean: true,
          app_id: "iAgkjaR2s2ws1XXtS5sVxE7H-MdYXbMMI",
          app_key: "vKka6XRlblVTkbKz8jLXx6EQ",
          placeholder: "你是来自评论区的小惊喜吗 ...",
          path: "window.location.pathname",
          avatar: "retro",
          meta: "["nick","mail"]",
          pageSize: "10",
          lang: "zh-CN",
          highlight: false,
          recordIP: true,
          serverURLs: "",
            // 设置Bilibili表情包地址
            emojiCDN: '//i0.hdslb.com/bfs/emote/', 
            // 表情title和图片映射
            emojiMaps: {
            "tv_doge": "6ea59c827c414b4a2955fe79e0f6fd3dcd515e24.png",
            "tv_亲亲": "a8111ad55953ef5e3be3327ef94eb4a39d535d06.png",
            "tv_偷笑": "bb690d4107620f1c15cff29509db529a73aee261.png",
            "tv_再见": "180129b8ea851044ce71caf55cc8ce44bd4a4fc8.png",
            "tv_冷漠": "b9cbc755c2b3ee43be07ca13de84e5b699a3f101.png",
            "tv_发怒": "34ba3cd204d5b05fec70ce08fa9fa0dd612409ff.png",
            "tv_发财": "34db290afd2963723c6eb3c4560667db7253a21a.png",
            "tv_可爱": "9e55fd9b500ac4b96613539f1ce2f9499e314ed9.png",
            "tv_吐血": "09dd16a7aa59b77baa1155d47484409624470c77.png",
            "tv_呆": "fe1179ebaa191569b0d31cecafe7a2cd1c951c9d.png",
            "tv_呕吐": "9f996894a39e282ccf5e66856af49483f81870f3.png",
            "tv_困": "241ee304e44c0af029adceb294399391e4737ef2.png",
            "tv_坏笑": "1f0b87f731a671079842116e0991c91c2c88645a.png",
            "tv_大佬": "093c1e2c490161aca397afc45573c877cdead616.png",
            "tv_大哭": "23269aeb35f99daee28dda129676f6e9ea87934f.png",
            "tv_委屈": "d04dba7b5465779e9755d2ab6f0a897b9b33bb77.png",
            "tv_害羞": "a37683fb5642fa3ddfc7f4e5525fd13e42a2bdb1.png",
            "tv_尴尬": "7cfa62dafc59798a3d3fb262d421eeeff166cfa4.png",
            "tv_微笑": "70dc5c7b56f93eb61bddba11e28fb1d18fddcd4c.png",
            "tv_思考": "90cf159733e558137ed20aa04d09964436f618a1.png",
            "tv_惊吓": "0d15c7e2ee58e935adc6a7193ee042388adc22af.png",
            "tv_打脸": "56ab10b624063e966bfcb76ea5dc4794d87dfd47.png",
            "tv_抓狂": "fe31c08edad661d63762b04e17b8d5ae3c71a757.png",
            "tv_抠鼻": "c666f55e88d471e51bbd9fab9bb308110824a6eb.png",
            "tv_斜眼笑": "911f987aa8bc1bee12d52aafe62bc41ef4474e6c.png",
            "tv_无奈": "ea8ed89ee9878f2fece2dda0ea8a5dbfe21b5751.png",
            "tv_晕": "5443c22b4d07fb1907ccc610c8e6db254f2461b7.png",
            "tv_流汗": "cead1c351ab8d79e9f369605beb90148db0fbed3.png",
            "tv_流泪": "7e71cde7858f0cd50d74b0264aa26db612a8a167.png",
            "tv_流鼻血": "c32d39db2737f89b904ca32700d140a9241b0767.png",
            "tv_点赞": "f85c354995bd99e28fc76c869bfe42ba6438eff4.png",
            "tv_生气": "26702dcafdab5e8225b43ffd23c94ac1ff932654.png",
            "tv_生病": "8b0ec90e6b86771092a498c54f09fc94621c1900.png",
            "tv_疑问": "0793d949b18d7be716078349c202c15ff166f314.png",
            "tv_白眼": "c1d59f439e379ee50eef488bcb5e5378e5044ea4.png",
            "tv_皱眉": "72ccad6679fea0d14cce648b4d818e09b8ffea2d.png",
            "tv_目瞪口呆": "0b8cb81a68de5d5365212c99375e7ace3e7891b7.png",
            "tv_睡着": "8b196675b53af58264f383c50ad0945048290b33.png",
            "tv_笑哭": "1abc628f6d4f4caf9d0e7800878f4697abbc8273.png",
            "tv_腼腆": "89712c0d4af73e67f89e35cbc518420380a7f6f4.png",
            "tv_色": "61822c7e9aae5da76475e7892534545336b23a6f.png",
            "tv_调侃": "4bc022533ef31544ca0d72c12c808cf4a1cce3e3.png",
            "tv_调皮": "b9c41de8e82dd7a8515ae5e3cb63e898bf245186.png",
            "tv_鄙视": "6e72339f346a692a495b123174b49e4e8e781303.png",
            "tv_闭嘴": "c9e990da7f6e93975e25fd8b70e2e290aa4086ef.png",
            "tv_难过": "87f46748d3f142ebc6586ff58860d0e2fc8263ba.png",
            "tv_馋": "fc7e829b845c43c623c8b490ee3602b7f0e76a31.png",
            "tv_鬼脸": "0ffbbddf8a94d124ca2f54b360bbc04feb6bbfea.png",
            "tv_黑人问号": "45821a01f51bc867da9edbaa2e070410819a95b2.png",
            "tv_鼓掌": "1d21793f96ef4e6f48b23e53e3b9e42da833a0f6.png"
                // ... 更多表情
            }
        });
      });
    }
    createObserver(loadValine, 'vcomments');
  </script>
      <style>
        #vcomments textarea {
            box-sizing: border-box;
            background: url("/img/v2-f3d5c26e7ac0da80ee72b6dc178d6aa1_b005.gif") 100% 100% no-repeat;
        }
      </style>
  <noscript>Please enable JavaScript to view the <a target="_blank" href="https://valine.js.org" rel="nofollow noopener noopener">comments
      powered by Valine.</a></noscript>
 -->

              </article>
            
          </article>
        </div>
      </div>
    </div>
    
      <div class="d-none d-lg-block col-lg-2 toc-container" id="toc-ctn">
        <div id="toc">
  <p class="toc-header"><i class="iconfont icon-list"></i>&nbsp;目录</p>
  <div id="tocbot"></div>
</div>

      </div>
    
  </div>
</div>

<!-- Custom -->

  <div class="col-lg-7 mx-auto nopadding-md">
    <div class="container custom post-content mx-auto">
      <img src="/img/371905140-ROBOT-WAVING-400px-unscreen(1).gif" srcset="/img/loading.gif" class="rounded mx-auto d-block mt-5" style="width:200px; height:200px;" >
    </div>
  </div>


    
  </main>

  
    <a id="scroll-top-button" href="#" role="button">
      <i class="iconfont icon-arrowup" aria-hidden="true"></i>
    </a>
  

  
    <div class="modal fade" id="modalSearch" tabindex="-1" role="dialog" aria-labelledby="ModalLabel"
     aria-hidden="true">
  <div class="modal-dialog modal-dialog-scrollable modal-lg" role="document">
    <div class="modal-content">
      <div class="modal-header text-center">
        <h4 class="modal-title w-100 font-weight-bold">搜索</h4>
        <button type="button" id="local-search-close" class="close" data-dismiss="modal" aria-label="Close">
          <span aria-hidden="true">&times;</span>
        </button>
      </div>
      <div class="modal-body mx-3">
        <div class="md-form mb-5">
          <input type="text" id="local-search-input" class="form-control validate">
          <label data-error="x" data-success="v"
                 for="local-search-input">关键词</label>
        </div>
        <div class="list-group" id="local-search-result"></div>
      </div>
    </div>
  </div>
</div>
  

  

  

  <footer class="mt-5">
  <div class="text-center py-3">
    <div>
      <a href="https://hexo.io" target="_blank" rel="nofollow noopener"><span>Hexo</span></a>
      <i class="iconfont icon-love"></i>
      <a href="https://github.com/fluid-dev/hexo-theme-fluid" target="_blank" rel="nofollow noopener">
        <span>Fluid</span></a>
        <br>
        <span>©2019 - 2020 By</span>
        <a href="https://github.com/rainrime" target="_blank" rel="nofollow noopener"><span>kunzh</span></a>
    </div>
    
  <div class="statistics">
    
    

    
      
        <!-- 不蒜子统计PV -->
        <span id="busuanzi_container_site_pv" style="display: none">
            总访问量 
            <span id="busuanzi_value_site_pv"></span>
             次
          </span>
      
      
        <!-- 不蒜子统计UV -->
        <span id="busuanzi_container_site_uv" style="display: none">
            总访客数 
            <span id="busuanzi_value_site_uv"></span>
             人
          </span>
      
    
  </div>


    

    
  </div>
</footer>


<!-- SCRIPTS -->
<script  src="https://cdn.staticfile.org/jquery/3.4.1/jquery.min.js" ></script>
<script  src="https://cdn.staticfile.org/twitter-bootstrap/4.4.1/js/bootstrap.min.js" ></script>
<script  src="/js/debouncer.js" ></script>
<script  src="/js/main.js" ></script>

<!-- Plugins -->


  
    <script  src="/js/lazyload.js" ></script>
  



  



  <script defer src="https://cdn.staticfile.org/clipboard.js/2.0.6/clipboard.min.js" ></script>
  <script  src="/js/clipboard-use.js" ></script>



  <script defer src="https://busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js" ></script>





  <script  src="https://cdn.staticfile.org/tocbot/4.11.1/tocbot.min.js" ></script>
  <script>
    $(document).ready(function () {
      var boardCtn = $('#board-ctn');
      var boardTop = boardCtn.offset().top;

      tocbot.init({
        tocSelector: '#tocbot',
        contentSelector: '#post-body',
        headingSelector: 'h1,h2,h3,h4,h5,h6',
        linkClass: 'tocbot-link',
        activeLinkClass: 'tocbot-active-link',
        listClass: 'tocbot-list',
        isCollapsedClass: 'tocbot-is-collapsed',
        collapsibleClass: 'tocbot-is-collapsible',
        collapseDepth: 6,
        scrollSmooth: true,
        headingsOffset: -boardTop
      });
      if ($('.toc-list-item').length > 0) {
        $('#toc').css('visibility', 'visible');
      }
    });
  </script>



  <script  src="https://cdn.staticfile.org/typed.js/2.0.11/typed.min.js" ></script>
  <script>
    var typed = new Typed('#subtitle', {
      strings: [
        '  ',
        "bomb lab&nbsp;",
      ],
      cursorChar: "_",
      typeSpeed: 70,
      loop: false,
    });
    typed.stop();
    $(document).ready(function () {
      $(".typed-cursor").addClass("h2");
      typed.start();
    });
  </script>



  <script  src="https://cdn.staticfile.org/anchor-js/4.2.2/anchor.min.js" ></script>
  <script>
    anchors.options = {
      placement: "right",
      visible: "hover",
      
      icon: "❡"
      
    };
    var el = "h1,h2,h3,h4,h5,h6".split(",");
    var res = [];
    for (item of el) {
      res.push(".markdown-body > " + item)
    }
    anchors.add(res.join(", "))
  </script>



  <script  src="/js/local-search.js" ></script>
  <script>
    var path = "/local-search.xml";
    var inputArea = document.querySelector("#local-search-input");
    inputArea.onclick = function () {
      searchFunc(path, 'local-search-input', 'local-search-result');
      this.onclick = null
    }
  </script>



  <script  src="https://cdn.staticfile.org/fancybox/3.5.7/jquery.fancybox.min.js" ></script>
  <link  rel="stylesheet" href="https://cdn.staticfile.org/fancybox/3.5.7/jquery.fancybox.min.css" />

  <script>
    $('#post img:not(.no-zoom img, img[no-zoom]), img[zoom]').each(
      function () {
        var element = document.createElement('a');
        $(element).attr('data-fancybox', 'images');
        $(element).attr('href', $(this).attr('src'));
        $(this).wrap(element);
      }
    );
  </script>





  

  
    <!-- KaTeX -->
    <link  rel="stylesheet" href="https://cdn.staticfile.org/KaTeX/0.11.1/katex.min.css" />
  



  
  
    <script type="text/javascript">
      //定义获取词语下标
      var a_idx = 0;
      jQuery(document).ready(function ($) {
        //点击body时触发事件
        $("body").click(function (e) {
          //需要显示的词语
          var a = new Array("富强", "民主", "文明", "和谐", "自由", "平等", "公正", "法治", "爱国", "敬业", "诚信", "友善");
          //设置词语给span标签
          var $i = $("<span/>").text(a[a_idx]);
          //下标等于原来下标+1  余 词语总数
          a_idx = (a_idx + 1) % a.length;
          //获取鼠标指针的位置，分别相对于文档的左和右边缘。
          //获取x和y的指针坐标
          var x = e.pageX, y = e.pageY;
          //在鼠标的指针的位置给$i定义的span标签添加css样式
          $i.css({
            "z-index": 999,
            "top": y - 20,
            "left": x,
            "position": "absolute",
            "font-weight": "bold",
            "color": rand_color()
          });
          // 随机颜色
          function rand_color() {
            return "rgb(" + ~~(255 * Math.random()) + "," + ~~(255 * Math.random()) + "," + ~~(255 * Math.random()) + ")"
          }
          //在body添加这个标签
          $("body").append($i);
          //animate() 方法执行 CSS 属性集的自定义动画。
          //该方法通过CSS样式将元素从一个状态改变为另一个状态。CSS属性值是逐渐改变的，这样就可以创建动画效果。
          //详情请看http://www.w3school.com.cn/jquery/effect_animate.asp
          $i.animate({
            //将原来的位置向上移动180
            "top": y - 180,
            "opacity": 0
            //1500动画的速度
          }, 1500, function () {
            //时间到了自动删除
            $i.remove();
          });
        });
      })
      ;
    </script>
  



  <script>(function (i, s, o, g, r, a, m) {
      i['DaoVoiceObject'] = r;
      i[r] = i[r] ||
        function () {
          (i[r].q = i[r].q || []).push(arguments);
        };
      i[r].l = 1 * new Date();
      a = s.createElement(o);
      m = s.getElementsByTagName(o)[0];
      a.async = 1;
      a.src = g;
      a.charset = 'utf-8';
      m.parentNode.insertBefore(a, m);
    })(window, document, 'script', ('https:' === document.location.protocol ? 'https:' : 'http:') + "//widget.daovoice.io/widget/244aa65c.js", 'daovoice');
    daovoice('init', {
      app_id: "244aa65c",
    });
    daovoice('update');
  </script>






  <script  src="https://cdn.staticfile.org/mermaid/8.5.0/mermaid.min.js" ></script>
  <script>
    if (window.mermaid) {
      mermaid.initialize({"theme":"default"});
    }
  </script>




  

  

  

  

  

  





</body>
</html>
